Friday Squid Blogging: Baby Sea Otters Prefer Shrimp to Squid

At least, this one does.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Read my blog posting guidelines here.

Posted on December 15, 2017 at 4:21 PM • 164 Comments


oh reallyDecember 15, 2017 5:12 PM

I enjoyed Brian Krebs takedown of "Anna Senpai" and I hope Paras gets the MAXIMUM.

These people need to be made examples of one way or another.

Sancho_PDecember 15, 2017 6:13 PM

@oh really

Yes, but the other way:

These guys should be rewarded and hired by the gov.
Find the probs where they are.

Ed Snowden for President!
Bright youngsters at his disposal.
Fire the corrupt gang above 40, because they destroy our kid's future.

Or something like that.

jack scheisseDecember 15, 2017 6:39 PM

1. We all know that designing malware that can delete itself is trivial for a competent programmer.

2. We also know that hacking any Windows system is trivial for modern crackers.

3. We also know that the advanced crackers of the world can ride USB devices to infiltrate even air-gapped systems (not that (I assume) our voting machine security here in the US is that sophisticated), especially if those are older systems.

So, where is the analysis on the probability that our voting machines were, indeed, hacked and modified to statistically nudge November's election towards Trump enough to tilt the outcome towards him but with statistical margins small enough to not ring too many bells?

So, if the voting machines were more than a few years old and running Windows, it seems to me that actually hacking the election would not have even been that difficult for Russia's crackers, who are certainly world-class and well-funded.

I'm very curious to see what y'all think about this, or if there is already an independent, serious analysis on this matter.

(I do understand that this very well may be an issue that could be rightly suppressed from the public as what the eff would we do if it was proven -- switch to Hillary?)

Avid ReaderDecember 15, 2017 6:59 PM

I was looking for something interesting to read and stumbled across Silence on the Wire. Is this book still relevant today and how meaningful are its contents viewing them in this post-Snowden era?

Maybe I am spoiled by Secrets & Lies, which still remains such an interesting and fresh book, and which I mention just to set the tone for the recommendations I am after.

ClipperDecember 15, 2017 7:06 PM

Intel announced that they will make it impossible to disable ME using the HAP bit. This only means that the market for a new CPU manufacturer gets more and more mature. A CPU with Ivy Bridge performance and no ME or similar backdoors would sell like hot cakes.

ShavedMyWhiskersDecember 15, 2017 7:12 PM

There has been a lot of concern about net neutrality.
There has been a lot of concern about interference in the election process.

Missing is concern about the regulatory process.
“As many as 2 million comments” on the US Federal Communications Commission’s proposal to repeal Obama-era net neutrality rules were faked, the office of the attorney general of New York has found."

Since the regulations behind the ACA have ten times the page count, Since the page count authorizing the EPA are dwarfed by the regulatory set of the EPA... Agency after agency... We are ruled by regulations more than law and the law has no consequences or awareness that the regulatory process is broken.

To compound this citizens can send letters to congress via the .gov web sites but there is little or no feedback. Did I or did I not send a letter last week? It is possible that hacked home machines (malware and viruses) could be used to allow foreign agents to flood the system. The issue is not restricted to foreign nationals. A chemical or pharma company could contract to a campaign to tip the scales in the feedback and review process to hobble competition. Russia may have done nothing that Madison Avenue does not already do for their clients. The tools of Madison Ave. have evolved more than most comprehend.

Back to net neutrality...
By way of example Alabama election: Doug Jones scores stunning win... It should be noted that last mile network providers could tip elections one way or another in the future. A geographic review by district could have on line campaign content filtered, slowed, sped up or even edited in small hard to detect areas. Get out the vote messages by both sides could be slowed to keep turn out way down or the reverse in specific geographies.
Candidate Party Votes
Doug Jones Democrat 671,151
Roy Moore Republican 650,436
Margin 20,716 A low percentage is within expectation of manipulation IMO.

PL1December 15, 2017 7:50 PM

@ Jack Scheisse, though you are barking up the wrong tree, your tree is right next to the right tree, so pretty good.

There is something that is even easier than hacking crap voting machines. Here's what you do. Write a couple lines in Scheisse-SQL with the following logical test:

Got a namesake in another state? Live in a Blue district? You're off the rolls, you fraud!

No zero-days, no airgap-hopping exploits. Any Scheisskopf can do it. And the evidence shows that is exactly what was done.

This was sufficient, but not necessary, to put Trump in office. And it was done by Republicans, not Russians. Russians can't do it, Republicans can. And why would Russians do it? Do you think they care which CIA puppet ruler Putin poses with? They know who's in charge - the same people who've been firmly in charge since November '63. CIA.

MarkDecember 15, 2017 8:05 PM


I remember the good ol' days when people used to bus across state borders to collect multiple welfare checks....

and coincidentally they were all democrats...

curious if they did the same thing with votes...

jack scheisseDecember 15, 2017 8:20 PM

@ PL1

The fact is that Putin wanted Trump because he is by far the weaker leader and is likely to be already well compromised by his shady business dealings that probably included Russian money and may have included Russian hookers.

But, yeah, the voter roll issue is significant as well, but you are discounting the depth of the Russian intelligence apparatus and Putin's strategic advantage in having a dementia-addled fool as PotUS. I mean, look at the corrupt, incompetent idiots he has surrounded himself with.

And your claims about the CIA seem tenuous at best, deliberate misinformation at worst.

Winston SmithDecember 15, 2017 9:46 PM

Please leave the half-baked theories colored by emotionally-charged political belief systems off the table. It's embarrassing and repulsive to watch the conversations devolve into diatribes steered by selection and confirmation bias.

I miss the fantastic, intelligent discussions about security/privacy. It's what made this blog a real gem.

Here's an ice breaker: AI and machine-learning can assist with security and privacy. But I suspect it can also be a formidable enemy in the future:

PLlDecember 15, 2017 9:50 PM

Thanks for the heads-up, @Jack! By the way, how do you come by your evident familiarity with the Russian intelligence apparatus? Ever been there? Ты говори́шь по-ру́сски? Have you met any members of the Russian intelligence apparatus? What clearances do you have? You sound pretty authoritative, so maybe we have some mutual acquaintances!

And what is this about the CIA? Surely you are not part of the dwindling rump that cannot accept that CIA shot Kennedy? Perhaps you could explain to us which of the overwhelming exhaustively-documented evidence below is merely tenuous and which is deliberate misinformation.

Thanks for your help!

echoDecember 15, 2017 9:53 PM

This is not a recent study but applies in a general way to large organisations and professions. Issues of lying or, depending on your point of view, versions of the truth is relevant to standards, reliability, and relevancy. The video is a presentation from last year.

Lying to ourselves: Dishonesty in the army profession

I perceive echoes of this kind of analysis across the board. Some of the more recent UK public sector scandals involve lying or complicity of this kind. It can be very difficult for vulnerable people to protect themselves when the system fails. All too often there is bad to none existant recovery from failure.

I am not aware of an equiavlent UK study.

WaelDecember 15, 2017 9:58 PM


Thanks for the Wired link (How a dorm room...) Captivating read and also an eye opener.

I usually don't read Wired... this was a well-written piece.

oh reallyDecember 15, 2017 11:07 PM

"These guys should be rewarded and hired by the gov."

There are plenty of non-scumbags who know how these things work who can be hired for that.

WaelDecember 15, 2017 11:15 PM

@Winston Smith,

Here's an ice breaker: AI and machine-learning can assist with security and privacy

That's known and already deployed since a while back in several industries. The thing I'm not sure about is the iterative supervised / unsupervised loop. I challenge the claim that this technique detects 85% of cyber attacks for the simple reason that human 'evaluators' aren't infallible; they won't detect 100% of the attacks, especially attacks that use unknown methods. How about compound attacks?

But I suspect it can also be a formidable enemy in the future:

Probably true. AI against AI. We've seen that in the chess world (I'm using AI loosely here.) Powerful chess engines running on a home PC can obliterate the world champion. Humans have no chance.

WaelDecember 15, 2017 11:35 PM

@ oh really,

There are plenty of non-scumbags who know how these things work who can be hired for that.

That's right!


"These guys should be rewarded and hired by the gov."

Nonsense! May fire and brimstone consume any:
PeepingTom, DickHead, and DirtyHarry© that hacks into my IoT devices. If that sounds too harsh, then at the very least they need to do a nickel at Gitmo.

tyrDecember 16, 2017 1:57 AM

@Winston Smith

I ran into an odd anecdote done by Calandale
on youtube. His story was that a highly
trained neural net had showed great promise.
The team wanted to show this marvel off so
they took it to another university and it
failed. Careful checking revealed that the
environment had changed as an input and it
skewed the results.

This is part of the AI problem, once the looneys
get something that looks good on the bench it
will move into the wider job without adequate
verification unless it causes obvious major
damage immediately. We've seen this before in
broken math co-processors so there's no reason
to hope everything will be flawless with AI
Gee whizz innovations.

The Net tries to tailor what you see now as the
corpse struggles for your clicks using your
revealed confirmation biases. The real dangers
are that once AI starts morphing that process
we're all in the Skinner box and happy about being
right all the time.

And for Wael:

I'm glad to be a Beta
cause we don't work so hard

Don't wanta be an Alpha
because they think too hard

The poor and lonely Gamma
has been made into a retard

Clive RobinsonDecember 16, 2017 2:26 AM

@ oh really, Sancho_P, Wael,

There are plenty of non-scumbags who know how these things work who can be hired for that.

Whilst that might be true, they were not getting hired to solve the gaping security faults, were they...

The point is most Internet vulnerabilities at the protocol and standards layers have been there since day one. Because they were quite deliberately built in from day zero.

It was almost certainly not done maliciously but to "solve problems within resource constraints" that no longer apply.

The thing is nobody wants to spend money to solve these problems, usually portrayed with the excuse of "don't break legacy systems" as it's the almost perfect "get out clause". As well as the biggest soirce of not just technical debt but building in security vulnerabilities across the board.

Since these three individuals dod what they did they kicked the "don't break legacy systems" argument "out the park" because they demonstrated beyond any reasonable doubt that "All systems are broken"...

No they are not heros, yes they are villains, but then so are the people who sat on their hands quite deliberatly not doing the clean up they should have been doing... The trouble is that the later set of villains get to not just go home at night, but also to carry on sitting on their hands looking the other way.

Thus continuing to not hire the "plenty of non-scumbags who know how these things work" and could fix them befor yet more technical debt becomes existential...

The fact that we have potential avalanche after avalanche of these existential technical debts to deal with, means beyond doubt that security practioners and snake oil salesmen will be happily in business side by side for some considerable time to come...

WaelDecember 16, 2017 3:02 AM


I'm glad to be a Beta cause we don't work so hard Don't wanta be an Alpha because they think too hard The poor and lonely Gamma has been made into a retard

And the lucky bastard omega
Sit on their fat lazy backside lard

Handing over to @Clive Robinson...

Clive RobinsonDecember 16, 2017 4:05 AM

@ tyr, Wael,

What happened to the "Deltas" that did the important things like "Telephone Sanitation"?

They might not be giants but we all stand on their shoulders to survive if not thrive...

As for those "essential fats", they tend to be liggt lipids thus very slippery... So I'll hand you back over to Wael...

Pete FormanDecember 16, 2017 4:21 AM

I have just purchased a OneForAll universal remote for TV, etc. The configuration can be done using an internet service. You upload a Settings.bin file, assign buttons to manufacturers’ devices and download the new settings.

At no point are you asked to register. That strikes me as very sensible. There are too many services that slurp in personal data that is not necessary.

IsmarDecember 16, 2017 4:23 AM

Re Wire article it is interesting that in such a long article there is no mention of how dismal the security of the IoT devices is . Instead emphasis is on how good the hacking skills of these individuals are completely missing the point that the whole scheme relied on the ease of being able to take control over these devices in the first place. This deliberate shift of focus of responsibility from the device manufacturers to these 3 individuals underlies bigger problems in our society which enable these events to take place with such frequency and consistency.

WaelDecember 16, 2017 6:13 AM

@echo ,

We need to talk about mathematical backdoors in encryption algorithms

Makes one think twice about "Trust the Math". Are we really trusting the math or are we trusting those who claim to have trusted the math. Also it's another argument for "Role your own algorithm" and "Cascade a few algorithms". The alternative is everyone needs to be able to verify the non-existence of mathematical backdoors. Probably using a tool, maybe MatLab or some sort of public formal proof.

The next best thing is to operate with the assumption that common algorithms have backdoors and take the necessary design and OpSec steps to close those doors. Search for C-v-P for some rudimentary analysis.

I do agree that not all weaknesses are implementation weaknesses. We had this sort of discussion with @Nick P (MIA) and @Clive Robinson in the distant past.

WaelDecember 16, 2017 6:27 AM

@Clive Robinson, @tyr,

So I'll hand you back over to...

I ended the poem with Omega to close further composition doors and make it extremely difficult for you to continue ;)

@Wesley Parish,

Merry Xmas, fellow code nerds: Avast open-sources decompiler...

Ask Santa for Ida pro. Ho ho ho. And if you're clever enough, you might be able to get three gifts on three different dates[1]

[1] keeping in mind that a lunar calendar was used back then. So the day won't be the same every year in the currently used calendar. It'll shift by around 13 days eatlier every year.

SheilaDecember 16, 2017 6:45 AM

A tiny story I hope is a harbinger.

"Lock out: The Austrian hotel that was hacked four times
. . . And he's moved back to traditional metal keys."

Personally and professionally, I'm avoiding, circumventing and retreating from "new technology" out of protest as much as as out of concern.

If market forces were intelligent, they'd have figured out the likes of us by now--the people who at first see no reason to "upgrade" themselves and then increasingly see valid reasons not to.

Clive RobinsonDecember 16, 2017 7:50 AM

@ Wael,

It'll shift by around 13 days eatlier every year.

You might want to take your mind off of breakfast --EATlier-- and reword what you've said.

Hint see how the Chinese Luna calender works with Chinese New Year... Oh and 365/13 ~= 28...

WaelDecember 16, 2017 8:24 AM

@Clive Robinson,

Okay. 10 or 11 days. So it moves backwards, not forwards. My breakfast, I just finished now. A cup of tea with milk and a small baguette with Swiss cheese...

I should stay away from calculations this early in the day ;)

RachelDecember 16, 2017 9:25 AM


owing to the lack of spacing for legibility i didnt pay attention to the wired article link until you pointed it out. i only read it because you enjoyed it so much. well, someone managed to commit 'journalism'. it was above average although the bar is set so low.
a number of gaps and leaps in narrative.
what happened to the french teen they suspected at first - electric chair?
and they were genuinely surprised that a journalist was oppressed for doing their job - that has never happened before LOL. how did they simple 'sieze' the infected devices in Alaska fron householders?
Krebs didnt get the credit he deserved. but, agreed, lucid and well researched

RachelDecember 16, 2017 9:30 AM


Thorogood is resigned to doing billy ray cyrus covers in Vegas Tuesdays and Sundays from 19-21 for the rest of his working life for his sins. Its too hard being homeless and poor for me to pick up your challenge presently sorry.
Meant to add - was chuffed to see Mr Schneier quoted in article.
Cringed by the ' feeling is its either China or Russia'. I recall we gave him a hard time about that at the time, too

WaelDecember 16, 2017 9:42 AM


a number of gaps and leaps in narrative. what happened to the french teen they suspected at first

Oh, give them some credit. The parallel construction story isn't completed yet ;)

was chuffed to see Mr Schneier quoted in article. Cringed by the ' feeling is its either China or Russia'. I recall we gave him a hard time about that at the time, too

Same here, but I didn't want to bring it up. Well, I didn't cringe. I smiled. The bears and bamboos turned out to be pimple faced teens; the domestic specimen :-)

WaelDecember 16, 2017 9:51 AM


... poor for me to pick up your challenge presently sorry.

That's ok. I can't do it either. Too difficult. If I can't do it in five or ten minutes, then it's not worth the time.

CallMeLateForSupperDecember 16, 2017 10:08 AM

"Pardon me! Small bug in the subscripts."

Will the fix be pushed? If so, when? :-)

Petre PeterDecember 16, 2017 10:11 AM


keeping in mind that a lunar calendar was used back then.

Keeping in mind is not something i can reliably do anymore. The trade off was for a cloudy mind on someone else’s machine that, for me, is accessible through goto statements. If i knew at the time to replace the word statements with date i would have fill in my own Julian calendar and ask why are churches building web.sites instead of calendars.

RachelDecember 16, 2017 10:14 AM


re: Mr Schneiers attribution

to be fair the botnet in question is associated in the popular psyche with disabling the internet for half a day. The article makes the distinction this was not the work of the accused but a later variant post public release of code. And it not known publically who did that.

WaelDecember 16, 2017 10:20 AM

@Clive Robinson,

mind off of breakfast --EATlier-- and reword what you've said.

I wondered what you meant by that until I re-read my comment and saw this:

It'll shift by around 13 days eatlier every year.

I'm like: My spelling deteriorated so much, that you... you out of all people pokes fun at it. I must have hit rock bottom, dug deeper and struck oil, and continued to dig deeper.


Will the fix be pushed? If so, when?

Ain't no money in it. F*ck the consumer :)

Clive RobinsonDecember 16, 2017 10:49 AM

@ echo,

The El Reg article written by John Leyden you link to contains some obvious errors but the conclusion is spot on of,

    [Eric] Filiol concluded that reforms were needed in the way that cryptographic algorithms are selected, analysed and standardised. “It should be a fully open process mainly driven by the open crypto community,” he maintains.

However back to the errors and ommissions, the easiest to spot is Eric Filiol's assumption / assertion of,

    Serious countries (USA, UK, Germany, France) do not use foreign algorithms for high-security needs. They mandatorily have to use national products and standards (from the algorithm to its implementation),”

Is easily dispensed with one acronym "NATO". All the aliance countries have a need to intercommunicate securely not just at the tactical level but all the way up. Thus they use common crypto that is --assumed-- to be sufficient against other superpowers[1]. One obvious aspect of this is the improved GPS system crypto modules to prevent certain kinds of attack that the Russian's and North Korean's (probably China) have developed and tested.

As for,

    Our algorithm [was] made public in February 2017 and no one has proved that the backdoor is easily detectable [nor] have shown how to exploit it.”

This is an old chestnut, which you normaly find in the claims of "Snake Oil crypto algorithm sellers". The fact that nobody has found anything does not mean it is difficult / impossible to find, more likely it means nobody has been bothered to look...

In fact Eric Filiol kind of admits this with,

    “There is a strong asymmetry (based on the mathematics) between inserting a backdoor into an algorithm (what we did and which is supposed to be feasible and easy, at least from a computational aspect) and being able to prove its existence, detect and extract a backdoor”

AES got the academic scrutiny it did because there was significant benifits in not just submitting a candidate but looking hard to strike candidates down and out. Thus some but by bo means all serious open community cryptograpers had a look. Thus for "just another algorithm" Eric Filiol's is not going to get more than a cursory glance, and even if not you still would not expect much progress in 10months (people do have other commitments --like keeping their job-- that will be of a much higher priority).

What we do know is that the design that is now AES was neither the fastest or most secure algorithm in the competition, and worse used an entirely new crypto function. Thus unsurprisingly some people still harbour suspicions about it.

However as I've pointed out in the past the NSA certainly "rigged the contest" for AES with high probability. If you think it through, of this there is little doubt. Because they deliberatly left out "side channel" testing, which they would be more than well aware of the need for. Instead they put the emphasis on "speed / efficiency" both of which open up time based side channels big time that seriously leak information especially KeyMat bits.

They also made the "contest code" publicly as a precondition of entry, knowing that code cutters would just "cut-n-paste" the contest code into their products. Which supprise supprise is exactly what happened. In one case it was with a very popular crypto library... There are still copies of such time based side channel riddled AES code still in use... If you dig just a little and check the public information on NSA kit that uses AES like their IME you will see suprise suprise it is not certified except for "data at rest", which is a very big hint backed by large red flags and "here be dragons" writ large.

Which means if you encrypt / decrypt files whilst "on-line" the SigInt agencies such as GCHQ, NSA et al can from a close upstream node get the side channel times, without touching any where you can see their pressence...

Which is why this comment made me not only laugh ruefully but shake my head in a wry way as well,

    “If I cannot prove that the AES has a backdoor; no one can prove that there is none,” Filiol told El Reg. “And honestly, who would be mad enough to think that the USA would offer a strongly secure, military grade encryption algorithm without any form of control?"

A quick look at the history of the AES competition, shows that whilst it was organised by NIST much of it was done outside of the US. Whilst this would not preclude SigInt skullduggery in the selection process it would require several SigInt agencies working in a concerted way to "finesse it". Which makes it less likely than the NSA putting the fix in with the setting up of the competition.

Sometimes though, all you realy need to do is walk around the problem a little bit and see it from a different perspective. It's not as though the information is not already out there, and it's fairly trivial to find and put together.

Also as I tend to keep mentioning ;-) when using AES "on-line" the attackers communications end point reaches beyond the users security end point. Thus all the attacker has to do is a simple "end run" attack around the application to get at the plaintext "User Interface", which a shim etc in the driver code will do and has been done before with banking application malware on PC's and Smart Phones...

Further due to this it is also equally possible for an attacker to use a "store and forward" process such that if you use the same machine to encrypt/decrypt "Off-Line" then go online they still get the plaintext. Which is why I repeatedly talk about "energy-gapping with a strongly mandated and instrumented choke point as the secure to insecure crossing transfer channel".

Put simply for the main target audience of the NSA they don't need to actually backdoor the AES algorithm...

Which brings us onto Eric Filiol's comment of,

    "I am convinced that all export versions of encryption system contain backdoors in one way or another. This is a direct constraint from the Wassenaar agreement. In this respect, the crypto AG and other companies

Read the first part of that again... He's talking "systems" not "algorithms" here, which as I've said above is a racing certainty with regards time based side channels.

Years ago I did a proof of concept that leaked KeyMat info via side channels, not in the main algorithm but in the usage mode algorithm which is way easier to "backdoor". It's not to hard to do and as difficult to detect as it is to factor an RSA key (see the work of Adam Young and his accademic supervisor Moti Yung and "Cryptovirology"). To make a time based side channel "less obvious" you can use the priciples of "Low Probability of Intercept" (LPI) radio systems. Put simply you add "timing jitter" via a Direct Sequence Spread Spectrum" modulator. Look up how some DRM systems worked at the end of the 1990's and also the "JitterBugs" system that Prof Matt Blaze and his students Gaurav Shah and Andres Molina published...

As for the Crypto AG backdoors the NSA released in 2015 two copies of the same memo that had been redacted differently revealing quite a bit of the story. But part of it was still missing, and I was realy supprised when researchers and investigative journalists did not put other parts of it together.

For example you look up the countries that got the backdoored Crypto AG equipment you will find that one of them is Egypt... Now if you also happen to have a copy of Peter Wright's "Spycatcher" in there you will find out what one of the "oh so secret" but still not admitted techniques, that nearly caused Maggie Thatcher "to go red" with appoplexy (she certainly tried to bring the entire legal power of the State down on his head).

It was "An Acoustic Side Channel". Peter Wright and his side kick Tony Sale (of Bletchly Trust fame) who worked for the UK's MI5 had tapped the phone that went into the Egyption Embassy Crypto Room and using their "hook switch jumping" technique, they could hear the mechanical cipher system in use. From it's audio signiture they could tell a great deal about the wheel settings in use. This info went not just to GCHQ but back to the NSA and thus onto Crypto AG who made very slight mechanical changes to make the sound signitures easier to detect. Which I gather went into all their electromechanical cipher systems even those sold to friendly nations.

As I said I'm realy supprised that this has neither been leaked or found by researchers / journalists. For years GCHQ thus the NSA had been trying to keep the acoustic side channel unknown as it's one of the best "air-gap crossing" techniques there is... I thought that the BadBIOS events would have finnaly made the penny drop, but apparently it did not.

So there you go "You heard it first on Schneier on Security", yet again :-D

No doubt a certain Israeli Universtity will have a paper out about it in a month or so ;-)

[1] For the higher levels, especially between fixed points with good physical security, it's a reasonable bet that whatever the base encryption system is, it will probably use Super Encryption which may well be the good old fashioned "One Time Tape"...

Clive RobinsonDecember 16, 2017 11:33 AM

@ Rachel,

Cringed by the ' feeling is its either China or Russia'. I recall we gave him a hard time about that at the time, too

Yes we did, and for my sins I still do in a way. The attribution problem is as I keep pointing out a difficult one, usually riddled with assumptions. It's why I look for legal levels of proof in anything said. My view was and still is that I do not feel it wise to make a call on the outpourings of unnamed insider commentors quoted in newspapers who are in effect briefing a policy view point not fact. Which means I appear to be sitting on the fence...

However even long before that I've been pointing out "The Army of One" issue, or as someone else put it "The 400lb teenager sitting in their underpants in the back bedroom of their parents house problem". The underlying issue with information attacks is there is effectively an infinite force multiplier with zero cost to the attacker... Thus all the effort is in the design of an information weapon not it's deployment.

Where it goes wrong with "gut calls" is our physical world bias. Which in effect says "big deeds require big power". Which is an implicit and often wrong assumption and makes fools of us all if we don't double check.

I guess I look at the world differently to most which is why I also called "North Korea" as the US target for Stuxnet, that much later got reported as such.

Whilst I don't mind disagreeing with people or object when they disagree with me, if we both bring our facts and reasoning to the table it usually comes down to the "indefinables" as to which way you call it, which is fine nobody has a perfect view of events.

What does make me cringe though is people calling loudly and often rudely their unreasoned gut feeling as though it's handed down on stone tablets. Which has become almost a policy of the current political times where there has to be an existential threat to feed the press and public so they rant about that rather than the substantive issues...

Clive RobinsonDecember 16, 2017 11:45 AM

@ Laf,

+1, you got the right university almost as fast as blinking ;-)

However as you note,

2013 isn't even the first

I independently discovered it back in the 1980's and like many others tried to use the discovery as a low bandwidth computer to computer link. The problem back then was not just the low frequency response of moving coil speakers and mics making it a head ache, but the fact that there was not enough computing power to do the level of digital filtering required.

But a good example is Quantum Key Distribution, Gilles Brassard who launched it on the world back in 1984. He was known to remark that the noise of the polarizers told him what state the photon was going to be in...

Winston SmithDecember 16, 2017 1:17 PM


The problem of nonstationarity in data modeling efforts is one of the reasons why I'm not typing this from a beach while sipping a cocktail. (Personally spealing, my own efforts were expended in the late 90s)


Capital market data, especially, is noisy. I don't doubt that much of the data regarding attacks on IS/IT systems is noisy too. Add to the mix pattern recognition systems and "universal function aporoximators" like ANNs which will enhance both the attackers' and the defenders' efforts, and nonstationarity will develop into a pretty big speed bump.

Regardless, I think AI will be a fascinating aspect of future security advances.

Clive RobinsonDecember 16, 2017 2:03 PM

@ Albert,

Although I don't think 'Boom Supersonic' is a good choice for the company name

How about "Rip Offs unlimited"? The design is The Anglo-Franc Concord, with a different set of enginees...

Mind you ripping off Concord's design is nothing new, the Russian's did it with the ill fatrd "Koncordski" that had the little cannard wings and got jet washed into the ground when a french fighter on a photo reconasonce flight crossed it's path...

Then NASA, rather than come to the British who had designed Concords wings etc, went to the Russian's but little came of it...

The thing is the demand for flying cramped up in a toilet roll tube at mach 2 etc is not that much fun, and traveling in a supersonic aircraft is one of those "status" symbols of certain types...

Oh and there's the double jet lag issue when you fly from East to West of ariving before you left which is just plain weird. Mind you they did let you get away with stealing the glasses and cutlery...

Who?December 16, 2017 2:12 PM

@ Avid Reader

I was looking for something interesting to read and stumbled across Silence on the Wire. Is this book still relevant today and how meaningful are its contents viewing them in this post-Snowden era?

Indeed, why not? I suggest you reading this book and "Hacking: the art of exploitation" from the same publisher, the latter only if you are interested in debugging binaries (this one is a very good reference on gdb) or understanding the more technical details. Zalewski's book provides a good background knowledge about passive recoinnaissance.

Clive Robinson would add "this one is the reason air gapping is not enough," I suppose.

This book does not talk about certain technologies (except in some, maybe outdated now, parts like the analysis of the quality of PRNG on different operating systems and the initial sequence number selection algorithms used by these operating systems). The background remains up to date and sound, and will continue being this way. The principles describes on this book will remain valid until physics laws change (e.g. TEMPEST emissions will continue being a concern) or our biology changes (e.g. the study of input timing patterns to deduce important properties of users input by just looking at the amount of time between keystrokes).

It is an generic book on passive reconnaissance of signals, so it can hardly become irrelevant. But as a consequence it does not provide a lot of specific advice on protecting your own networks either.

albertDecember 16, 2017 3:38 PM


Don't be such a Negative Nelly :)

Here are some links for you:

The Boom design looks good on paper, and they seem to be doing everything right, i.e., leveraging existing and proven design, avoiding now-known risk factors.

The Concorde had an unblemished safety record for 27 years, until the first (and last) crash. Details in the wiki.

I'm wishing Boom Technology all the best (and you as well).

. .. . .. --- ....

WaelDecember 16, 2017 3:40 PM

@Clive Robinson,

One unhappy user has basically said no more, but more vociferously,

What are the chances the unhappy user is the developer of qutebrowser? And how long before qutebrowser gets bloated? I'm getting tired of FF myself.

echoDecember 16, 2017 4:27 PM

My personal focus is more political, with beaurocratic and social systems higher up my priorities than technical security implementations. That said I observe some general lessons which apply universally:

Do we trust the theory or the authority who backs the theory? This is a good question and in some fields this is changing for the better. I agree with the general point about openess. It is an effective guard against attempts to hijack systems. With repect to human rights and "passive reconnaisance" individual efforts to get their story out and reporting by the media have been very effective.

Good business practice is good security practice and vice versa?

echoDecember 16, 2017 4:47 PM

Following on from Surveillance Inside the Body ( I was reading the obiturary of Professor Heinz Wolff and noticed he produced "produced a radio pill that could measure pressure, temperature and acidity in the gut". This is my excuse for shoehorning this link into this topic!

I loved Heinz. He was always good fun and very inventive. Oh, for the days of long summers when ordinary people repaired their own things...

coulterbeastDecember 16, 2017 5:41 PM


Yeah for all the folks who are "tired, so tired" of hearing about Russian meddling and mischief, it's worth noting that some hundreds of thousands to millions of the FCC's anti-NN public posted comments posted used AMERICAN ID's and yet "somehow" managed to be sent DIRECTLY from known Russian IP addresses, verified.

They "just happened" to be in support of removing the protections. Go figureski.

Sancho_PDecember 16, 2017 6:42 PM


”... used AMERICAN ID's and yet "somehow" managed to be sent DIRECTLY from known Russian IP addresses, verified.”

So you say they were so stupid to accept "some hundreds of thousands to millions" inputs from “known Russian IP addresses” in an US process?

End of 2017?
Thank you! Fascinating story!

Sancho_PDecember 16, 2017 6:56 PM

@oh really, Wael, Clive Robinson re DDoS - parties

“There are plenty of non-scumbags who know how these things work who can be hired for that.”
I agree, only that the guys who do hire don’t want them.

Party compliance, rope teams, revolving doors and “Club of Wealth” are the key.

There must be an open, rewarded competition to find security vulnerabilities and possible improvements to make our critical infrastructure more resilient.
There must be an incentive to improve - by punishing bad solutions.

It’s not “we against them”, it’s our common future, we are an island.
Hiding behind classified is communism and/or corruption, not capitalism.

We are very good in finding excuses and explanations, we know that our existing system doesn’t work, but we old men don’t like changes.

Picking up speed we run against a full stop, and we know it? Nice.

Re: DDoS (the culprit in this case):

First of all, let’s blame the Russians. Or the Chinese. Or the rocket man.
Then get a napkin to wipe the foam off your mouth.
One thing is obvious: It's never our fault.

@Clive Robinson is right, both parties are villains.
But DDoS is known to be a deadly problem since years.
Still today it’s difficult to detect, to find botnets, CC servers, let alone to stop the attack.
Really? They watch kids exchanging porn, expose activists, listen cowardly to innocent communication but can’t help to protect the citizens, because …. um, why? Because DDoS is foreign?

And the corporations running the Net?
What did they do? Yep, find a business model to “protect” those who can pay (until they have to drop them).

My fridge can’t bring down Dyn. Even if my fridge, IP cameras, security system and sewage computer act together they can’t.
My single pipe can’t even bring down my ISP, it’s too small.

But my ISP’s pipe(s) are dangerous, at least in Spain’s part of the Net.

Now the questions:
Who executes DoS attacks, my devices or my ISP?
Can we change millions of uncontrollable / unchangeable devices?
Could we change these systems that really perform a DDoS?
If we really want?
(Don’t move! If you don’t move no one will notice you - this is called “official Pick up Sticks”)

Re: Their new scam business model

They exploit the add-scam industry. They increase scam business by scam, just increasing reactive power.
Brilliant. Watch the stock exchange fly.

May I ask:
If all my IoT-devices would continuously download adds, could I have my browsers add free then?

WaelDecember 16, 2017 7:44 PM

@Winston Smith,

Probably true. AI against AI. We've seen that in the chess world (I'm using AI loosely here.)

No longer 'loosely'. Google's self-learning AI AlphaZero masters chess in 4 hours and beats Stockfish. In another video, AlphaZero teaches Stockfish a lesson in the French Defense[1]. This is well beyond human capability. So yes, AI is a formidable foe. Perhaps too formidable.

[1] I'd like Google to publish a game where AlphaZero played a King's Gambit Accepted game against Stockfish (one of my favorite openings.)

SanchoClauseDecember 16, 2017 8:48 PM

"My single pipe can’t even bring down my ISP, it’s too small."

Oh I dunno, saturating a syn on a particular node could do the job regionally if you knew where/how to hit...

Clive RobinsonDecember 17, 2017 12:22 AM

@ Albert,

Don't be such a Negative Nelly :)

Although not English by ancestry, I do have the misfortune of living not in it's "green and plesant land" but the urban sprawl that is the SE that at night from space looks like the largest city in the world. It's dirty, it's mostly grey and damp, the beer warm and gassy, with most under 35 not able to buy there own flat, or for that matter rent so "live with mumsy or pater" thus have no sensible sex life outside of hotels, cars or round the back of somewhere.

We are also believed by others to have stiff upper lips, sock suspenders, string Y-fronts and mad demented feret eyed behaviour and carry rolled up umbrellas, thanks to John Clease.

Not only is accommodation expensive, but food likewise, so "ta hidiots hup narf" decide we should divorce our nearest and major trading partner because he's "job stealing johnny foreigner with weird behaviour stealing our women"... None of these hidiots have ever met a foreigner let alone one improbably called "Johnny"... Nore do they realise that those from the EU mainly keep the UK economy going and pay for the health care and other economic aid the hidiots hup narf get... So here we are with a totaly incompetent encumbrant Prime Minister without mandate. Who even having purchased DUP support at vast expense to England, finds they stab her in the back without a second thought. Thus the economy has tanked, savings are worthless and we appear to be going down for the third time, with not just rats swiming vigorously away at "best speed"...

And you say "Don't be such a Negative Nelly"...

What is the world comming to I realy don't know... Next you'll be telling me Trump is comming to visit...

There that's got that of my chest :-D

P.S. Oh and for those reading along, it's realy not that bad, it's actually a lot worse 0:)

Clive RobinsonDecember 17, 2017 12:37 AM

@ echo,

I was reading the obiturary of Professor Heinz Wolff

I met him once or twice when I was younger, and he was as mad and full of zest in real life as he appeared on TV.

He was an early recipient of a pace maker, years ago. And as he new his students would be concerned, he built a life size working model to show them how it all worked. There's a photo of him holding it at the hospital with even the cardiologist looking impressed.

One of natures "nice guys" who could even get granny excited about science and the world around us. He's left a hole that is going to be difficult to fill even half as well.

Winston SmithDecember 17, 2017 12:37 AM


..."French Defense[1]."

French surrender jokes aside, 28 wins and 72 draws is pretty good for someone who woke up that morning never having played.

Really interesting is that Alpha Zero is evaluating 875 times fewer moves per second. Assuming all other variables are equal, AlphaZero isn't just iterating potential moves and choosing the one with the highest chance of advancing a win, but it is demonstrating a deeper understanding of the overall strategies; likely even unwittingly taking into account the limitations of its opponent.

Formidable indeed. And now that Ai is a religion, we have even more reason to worry... maybe our new Ai overlord will deem security and privacy as an anathema to its new world order where such is no longer needed.

WaelDecember 17, 2017 12:39 AM

@Petre Peter,

Keeping in mind is not something i can reliably do anymore.

That's what the internet is for! Call it ''Cloud mind" or "Clouded mind" ;)

@Clive Robinson,

P.S. Oh and for those reading along, it's realy not that bad, it's actually a lot worse 0:)

You have my whole heart of sympathy! If life gives you lemons, make lemonade. Oh, wait a sec! Historically that's a bad example ;)

Getting worse everywhere.

65535December 17, 2017 12:41 AM

@ Clive Robinson

“How about "Rip Offs unlimited"? The design is The Anglo-Franc Concord, with a different set of enginees...”-Clive R.

Yes, but that is relatively small compared to the Japans Mitsubishi F-2B/F-16. K-street consultants at work against the USA.

“Mozilla are upseting people by taking commercial backhanders and enabaling what some think is in effect malware.” –Clive R.

I agree that the Pocket and Tiny Eye were hostile moves on the part of Mozilla. I did not find any tiny eye of pre-Quantum versions of Firefox that my customers use.

I like to follow the money for other clues. But, Mozilla. Is a sub-entity of the Mozilla Foundation and it is hard to see their finances.

The Subsidiary Mozilla Corporation is private so they make not SEC filing. The Mozilla corporations and Mozilla foundation do have odd but not overtly conflicts of interest with its customers – at least on the surface. But, who knows, they have to get their money from customers in any event. I while looking into certain secure web service and certain pre-paid cheap cell phones that there was indications of influence from TLA’s and IQtel.

Wikipedia on both the Mozilla Foundation and Mozilla corporation:

“…the Mozilla Foundation announced the creation of Mozilla Corporation, described as "a taxable subsidiary that serves the non-profit, public benefit goals of its parent, the Mozilla Foundation… esponsible for product development, marketing and distribution of Mozilla products."[8] It also handles relationships with businesses, many of which generate income. Unlike the Mozilla Foundation, the Mozilla Corporation is a tax-paying entity, which gives it much greater freedom in the revenue and business activities it can pursue. From 2004 to 2014, the majority of revenue came from a deal with Google, which was the default search engine in the Firefox web browser. In November 2014, Mozilla signed a five-year partnership with Yahoo,[9] making Yahoo Search the default search engine for Firefox in the US. Yandex Search is the default for Firefox in Russia and Baidu continues its role as the default in China… In 2006, the Mozilla Foundation received US$66.8 million in revenues, of which US$61.5 million is attributed to "search royalties" from Google… From 2004 to 2014, the foundation had a deal with Google to make Google Search the default in the Firefox browser search bar and hence send it search referrals; a Firefox themed Google search site was also made the default home page of Firefox. The original contract expired in November 2006. However, Google renewed the contract until November 2008 and again through 2011.[13] On December 20, 2011, Mozilla announced that the contract was once again renewed for at least three years to November 2014, at three times the amount previously paid, or nearly US$300 million annually. November 2014, Mozilla signed a five-year partnership (effective December 2014) with Yahoo!, making Yahoo! Search the default search engine for Firefox in North America. The default search engine in Russia will be Yandex, and in China, Baidu.[9] Due to Mozilla's financial release timetables, the results of the Yahoo! contract will not be public until November 2016… November 2017, however, Mozilla announced[17] that it was switching back to Google as the default search engine. This represented an early termination of its Yahoo partnership… Donations, 2006, after a request from Theo de Raadt of OpenBSD for funding from corporate entities which make a profit through the use of OpenSSH in their packaged distributions, the Mozilla Foundation donated US$10,000 to de Raadt and OpenBSD for OpenSSH development. The funds donated came from money earned through the income provided by Google. While the target of this request were corporations such as Cisco, IBM, HP, and Red Hat (which all sell operating systems containing OpenSSH but had not donated to its continued development before), the Mozilla Foundation found that without OpenSSH, much of the work done by developers would be through insecure and unsafe methods and thus gave the funds as a thank you… the Mozilla Foundation Board of Directors has eight members:[19]
• Mitchell Baker (Chair)
• Brian Behlendorf
• Bob Lisbonne
• Cathy Davidson
• Ronaldo Lemos
• Helen Turvey
• Mohamed Nanabhay[20]
• Nicole Wong[21]" -Wikipedia

Next to the sub-entity Mozilla Coporation:

"The board of directors is appointed by and responsible to Mozilla Foundation's board. In March 2014, half the board members resigned.[16] The remaining board members are:
• Mitchell Baker, Executive Chairwoman
• Reid Hoffman, former CEO of LinkedIn
• Chris Beard, CEO, former CMO[78]
The senior management team includes:
• Mitchell Baker, Executive Chairwoman
• Chris Beard, CEO
• Katharina Borchert, Chief Innovation Officer, formerly CEO of Spiegel Online[79]
• Jim Cook, CFO
• Jascha Kaykas-Wolff, CMO
• Denelle Dixon-Thayer, General Counsel & Senior Vice President, Business and Legal Affairs
• David Slater, Chief of Staff & Senior Vice President, Strategic Operations
Notable current employees
• Asa Dotzler, Director of Firefox Desktop[80]
• Boris Zbarsky
• David Baron (Computer Scientist)
• Eric Rescorla[81]
• Julian Seward
• Tantek Çelik
IRS audit : The Internal Revenue Service opened an audit of the Mozilla Foundation's 2004-5 revenues in 2008, due to its search royalties, and in 2009, the investigation was expanded to the 2006 and 2007 tax years, though that part of the audit was closed. As Mozilla does not derive at least a third of its revenue from public donations, it does not automatically qualify as a public charity… In November 2012, the audit was closed after finding that the Mozilla Foundation owed a settlement of $1.5 million to the IRS"


"Google: original deal with Google to have Google Search as the default web search engine in the browser expired in 2011, but a new deal was struck, where Google agreed to pay Mozilla just under a billion dollars over three years in exchange for keeping Google as its default search engine. The price was driven up due to aggressive bidding from Microsoft's Bing and Yahoo!'s presence in the auction as well. Despite the deal, Mozilla Firefox maintains relationships with Bing, Yahoo!, Yandex, Baidu, and eBay..[Google provided Mozillia with about 85% to 95% of its revenue, estimated to be over a half billion USD between 2005 to 2011 in total-ed]

"Yahoo [and back to Google]: November 2014, Mozilla signed a five-year partnership with Yahoo!, making Yahoo! Search the default search engine for Firefox browsers in the US.[48] With the release of Firefox Quantum on November 17th 2017, Google became the default search engine again..."

"Microsoft: Despite the cold reception from Microsoft's top management, the Internet Explorer development team maintains a relationship with Mozilla. They meet regularly to discuss web standards such as extended validation certificates.[54] In 2005, Mozilla agreed to allow Microsoft to use its Web feed logo in the interest of common graphical representation of the Web feeds feature… 2006, Microsoft offered to help Mozilla integrate Firefox with the then-forthcoming Windows Vista,[56] an offer Mozilla accepted… October 2006, as congratulations for a successful ship of Firefox 2, the Internet Explorer 7 development team sent a cake to Mozilla. As a nod to the browser wars, some jokingly suggested that Mozilla send a cake back along with the recipe, in reference to the open-source software movement.[60] The IE development team sent another cake on June 17, 2008, upon the successful release of Firefox 3,[61] again on March 22, 2011, for Firefox 4… yet again for the Firefox 5 release… November 2007, Jeff Jones (a "security strategy director" in Microsoft's Trustworthy Computing Group) criticized Firefox, claiming that Internet Explorer experienced fewer vulnerabilities and fewer higher severity vulnerabilities than Firefox in typical enterprise scenarios.[64] Mozilla developer Mike Shaver discounted the study, citing Microsoft's bundling of security fixes and the study's focus on fixes, rather than vulnerabilities, as crucial flaws… February 2009, Microsoft released Service Pack 1 for version 3.5 of the .NET Framework. This update also installed Microsoft .NET Framework Assistant add-on (enabling ClickOnce support).[66] The update received media attention after users discovered that the add-on could not be uninstalled through the add-ons interface.[67][68] Several hours after the website posted an article regarding this update, Microsoft employee Brad Abrams posted in his blog Microsoft's explanation for why the add-on was installed, and also included detailed instructions on how to remove it.[69] However, the only way to get rid of this extension was to modify manually the Windows Registry, which could cause Windows systems to fail to boot up if not done correctly… October 16, 2009, Mozilla blocked all versions of Microsoft .NET Framework Assistant from being used with Firefox and from the Mozilla Add-ons service.[70] Two days later, the add-on was removed from the blocklist after confirmation from Microsoft that it is not a vector for vulnerabilities."-Wikpedia

I would like to say Mozilla is a totally “independent company” that only cares for its users - but the cash flow realities seem to indicated the opposite. If any of you accountants or financial people know about odd arraignments with the USA Government, IQtel or the like speak up.

WaelDecember 17, 2017 1:16 AM

@Winston Smith,

And now that Ai is a religion

Read that. It's just a high tech version of idol worshipping.

but it is demonstrating a deeper understanding of the overall strategies; likely even unwittingly taking into account the limitations of its opponent.

Evidently the case! It realized Stockfish (one of the most powerful chess engines[1]) wanted to go for a draw. The move repetition Alphazero did could be a strategic method of extracting the opponents tendencies and goals. Traditional engines depend on a huge data base of openings and endings, sheer move evaluation calculations and accuracy reading the current 'numerical score'. They also use alpha-beta pruning to eliminate 'weak moves' and offset exponential explosion when looking many moves ahead. Alphazero seems to be doing something different. It's implied that it uses no book openings, and set its own learning parameters in only 4 hours!

maybe our new Ai overlord will deem security and privacy as an anathema

Count me a heretic, then! New world order inquisition coming to a region near you.

[1] I don't play against it. I had Chessmaster, Fritz, and Shredder (very close to Fritz, and a couple more) Only won one or two (three max, but I don't remember) games in like 7 years against Shredder / Fritz. Both were King's Gambit Accepted (me playing white.) One of them was a variation of the Ghulam Kassim Attack. The rest of the few thousand games, it shredded my butt.

Clive RobinsonDecember 17, 2017 1:25 AM

@ Wael,

Oh, wait a sec! Historically that's a bad example ;)

Not half, that's why "our colonial cousins" call us "limeys"...

It could have been worse we should by all rights have been called "Lemonys"...

It was back in the late 1759's that Scottish surgeon James Lind carried out what is now called "The world's first clinical trial". He carried it out on British Royal Navy sailors who were suffering and in quite a few cases dying quite horrible deaths from scurvy. From what we would now call "observational data" he concluded that something was missing from the British sailors diet. Then carried out a trial bassed on the data concluding that lemon or lime juice prevented scurvy.

We now know that scurvy is a disease caused by a lack of vitamin C and where it is most easily obtained. But back then it was just the juice of preserved lemons and limes.

Thus attempts were made to try to get supplies of preseved lemons. But for political reasons access was denied so the less palitable by a long way lime had to be used.

The quantiry originaly required back then realy was quite large thus it was with considerable reluctance it was drunk.

To make it more palatable many sailors drunk it with their rum ration. Which whilst still bitter actually became quite popular. It's popularity went up even further with the addition of raw cane suggar and thus one of the earliest cocktails had been made.

It was another Scott that actually got limes into British homes by developing rathee nice version of marmalade...

Anyway with regards ancestors mine are mainly Scottish with some Ebglish and German.

Oh and I'm told I look more like a younger "Bob 'the bear' hite" from Caned Heat, than I do a Klingon... It's funny in a way because for a number of years I had the nickname of "Bru" short for the Dutch word for brown "Bruin" that became synonymus for ""

65535December 17, 2017 1:33 AM

@ all legal experts

There are two important legal cases in the system. I wonder what is the status or outcome.

1] The warrantless grabbing by police of cell phone tower data in the Carpenter v. United States which Bruce S. join in a brief. What is the status of that case?

2] The Keith Gartenlaub case in the 9th district court. That is the case where the FBI is charging Gartenlaub with child porn charges via a Nation Security search. This is complex because Gartenlaub was first thought to have somehow sold the plans to the Boeing heavy transport plane via his wife to the Chinese Government. Those charges apprear to be false and the only thing the FBI could find to accuse him with was old child porn on an old used computer in Gartenluabs house.

Any guess on the outcome of those two cases?

tyrDecember 17, 2017 4:43 AM

@Wael, Clive

If the Alpha and Omega are your limits you
haven't come from a culture with Ginnungagap
embedded in it.

@Winston Smith

I have no doubts about the abilities to build
some version of AI, just questions about the
ability to use overly complex systems wisely.

I'm continually amazed at the folk who allow
the Rus secret powers of persuasion so dire
they can manipulate political processes.
Having plowed through Vilfredo Pareto and
seen how a first guess about how human society
works, I have serious doubts about easily
skewed systems being possible.

With the exception of serving as popcorn sales
ads for the entertainment of cynics modern
politics and ideologies are just painful
embarrassments to thinking people. Each new
clown act that arrives on the stage makes the
previous pale by its bad tastelessness and
strange posturings. I'm tempted to think that
McKenna was right when he said the truth no
one dares say is that no one is in charge.

echoDecember 17, 2017 5:19 AM

I discovered comment on the Google AI versus Stockfish match. The AI was trained on many more processors than used in the match, the processing power between the two was not equivalent, and moves were limited to one minute rather than the total time allowed. Additional links cover the orginal paper plus a reply from Stockfish creators.

As remarkable as Google AIs achievement is the questions arising in discussion about the heuristics (the bundle of intelligence accumulated with the AI versus the opening books etcetera) are interesting. While not directly connected buried in European case law a judge gives a very through explanation of the line between individual judgement of the ineffable and clearly reasoned judgements. (I will need to dig through my research notes for an exact citation.) The examination of this case law for what a "heuristic" means within a legal context in light of AI developments will I'm sure be an intriguing discussion.

echoDecember 17, 2017 5:59 AM

Thanks for your kind words about Heinz. I was hoping you or someone else might remember him.

I remembered reading an essay this morning on Alfred C. Hobbs defeating Chubb's unpickable lock.

This morning I bought a dock for my laptop. It comes with a set of keys (which areavailable seperately on EBay). I also have a set of locks to install on my desk drawers which I strongly suspect all have the same key. Should I be bothered? My use case is to dissuade casual passing curiosity. Bluff should be sufficient.

Self-Destruct Social MediaDecember 17, 2017 6:53 AM

Professionals confirm that staring at a tiny, bright Social Media screen for over 8 hours a day generates loneliness, depression, isolation. How do you release emotions especially at 2am! These lonely people need to blow off steam. But how? Griping

Social media outbursts of click-bait anger #MeToo undermine our basic society’s fabric and laws based upon due process.

This madness undermines the timeless male-female relationship and ability to repopulate the Earth. Especially the ability to raise children into becoming adults of high moral and ethical standards, a prerequisite for obtaining a security clearance.

The solution is to replace the dysfunctional trends of connected data-mining devices with those of traditional human or family values.
The choice that or be replaced. As the Washington Post states "Last year saw a record-low fertility rate, and an even sharper drop is predicted for 2017."
Thanks go to Wall St and Silicon Valley!

HermanDecember 17, 2017 8:32 AM

@Clive Robinson - The TU144 was completely different from the Concord. The persistent rip-off stories are just plain nonsense. If they really ripped something off, then it would have been better!

For a modern successful big supersonic platform, I think the TU166 strategic bomber would make a great (horribly expensive!) passenger plane.

Clive RobinsonDecember 17, 2017 10:07 AM

@ Hermann,

The persistent rip-off stories are just plain nonsense. If they really ripped something off, then it would have been better!

So you are definitely claiming it's a canard then ;-)

Which ever way the French certainly believed it and that --allegedly-- was the reason it went down in Paris...

Speaking of ripoff claims, stay tuned,

@ 65535,

Yes, but that is relatively small compared to the Japans Mitsubishi F-2B/F-16. K-street consultants at work against the USA.

Hey that's the Japanese just giving a little friendly competition...

If you want the real action, how about the Chinese --allegedly-- stealing the plans for the F-35 and thinking they had been given duds, thus reworking the design and got their protypes up and running a year or so before the first F-35's started droping bits in US airspace (or so the story goes ;-)

I just love these stories because they always have a germ of truth and hype about them. Having caught the French actually doing not just industrial espionage but also trying to jam other peoples sales demonstrations, it gives me a chance to kick back with a bowl of popcorn to watch the entertainment.

Speaking of which I'm sitting in the members room of a venerable institution in Greenwich South East London across the road from the old nuclear reactor, watching the tourists trog by below and playing the "Guess the Nationality" game over a drink in the warm and dry... It realy is a dirty grey damp and chilly PM, and would be sunset over the Royal Observitory if there was a break in the clouds... The sort of weather were you can not work out if it's a British Summer or Winter...

Bong-Smoking Primitive Monkey-Brained SpookDecember 17, 2017 10:42 AM

I ain't dead, I was on a secret mission. What you read in the past was fake news and nasty rumors.

Speaking of ripoff claims, stay tuned,

Alrighty, get the popcorn machine going: here is the definitive guide, a short video about the half-backed boing 2707, the Concord, and the TU-144. There are longer documentaries but I haven't watched them. This's a good video to watch.


Where did you disappear? You can always talk about a different subject -- no pressure! Or did you get a new directive from the chain of command?

CassandraDecember 17, 2017 10:47 AM


With your description of the SE of the UK, I can't help but think of the character played by Joan Harben in ITMA: "It's being so cheerful as keeps me going!"


On unexpected uses of 'side channel' audio, this doesn't qualify, but it is an interesting snippet, nonetheless - the use by UK investigators of recordings of mains hum to authenticate recordings and detect if they have been edited:

The hum that helps to fight crime

I'm most readers of this blog knew of it already, but many people don't, and think it is a fabricated story. The techniques involved are interesting.


hmmDecember 17, 2017 12:39 PM

"Social media outbursts of click-bait anger #MeToo undermine our basic society’s fabric and laws based upon due process."

You're conflating things that aren't related.

#Metoo is about women who were sexually assaulted in their workplace.

People who gripe about that in any forum have valid gripes. No, that isn't undermining society.

You can say people use too much social media, but that's an unrelated issue. Don't get mixed up.

WaelDecember 17, 2017 2:56 PM

@echo, @Winston Smith,

So this is a list of the 2017 Strongest Chess Engines. Houdini is Elo rated at 3527.

For comparison, Magnus Carlsen the current reining world champion peaked at 2880. That's a difference of 647 Elo points. AlphaZero, from what games Google shared would be a few hundred points higher than Houdini. It could be at an Elo rating if 4000 or possibly more.

Looked at the link and saw the comments. Seems AlphaZero is running on a TPU rather than a CPU that other engines run on. Regardless, the results are amazing. Google only needs to share more details, so we know the conditions weren't rigged in favor of AlphaZero!

Aside from chess, it would be very interesting to see other AI applications running on specialized HW and its effect on security and privacy (or what's left of it.)

Taking a short break...

Anonymous2bDecember 17, 2017 3:34 PM

TL;DR (about 4:15 or more if you want)
imo Trump's impact on the USA Judiciary is unfortunate, or a disaster, for a generation.

iirc Senator Grassley, a Republican, has asked Trump to withdraw a couple of names to be considered for Federal Judge lifetime appointments.

Since Senator McConnell, another Republican, is going full speed trying to reshape the USA Judiciary this is probably good.

On a lighter note Peterson presumably won't become a Federal Judge, but apparently he was good enough to go for an interview:

"As of Friday morning, a video of Matthew Spencer Petersen struggling with questions from Sen. John Kennedy, a Louisiana Republican, had been viewed more than 3 million times.

Petersen, who serves on the Federal Election Commission, had difficulty answering questions about the “Daubert standard,” which has to do with expert witness testimony, and the definition of a “motion in limine,” which has to do with the introduction of evidence. He acknowledged he has never tried a case or argued a motion in court. He said he last read the federal rules of evidence in law school."
MUST WATCH: Republican @SenJohnKennedy asks one of @realDonaldTrump’s US District Judge nominees basic questions of law & he can’t answer a single one. Hoo-boy.
— Sheldon Whitehouse (@SenWhitehouse) December 15, 2017"

hmmDecember 17, 2017 6:24 PM

At risk of enraging those who consider CNN's breathless 24-hour feed a greater threat than actual treason,
the only thing preventing partisan hacks from appointing partisan hacks to LIFETIME US FEDERAL JUDGESHIP
is total failure of the nominee to answer any single question related to law, in any capacity, at an expected rubber-stamp confirmation by 9/10th's partisan hacks who put party before God et al.

John Kennedy, *(R!) ardent Trump supporter (as gentle reader might notice) sums it up with country gravy :

"I don't think that the first time you set foot in a federal courtroom.. ought to be as a federal judge."

What bravery this Republican congress! Damocles if you're listening, drop it anytime.

"It was painful and I feel very badly for Mr. Petersen" - So true, poor guy right?
The real victim here, right?

A LIFETIME appointment to DEMI-GOD in our justice system without even the plausible whiff of ANY EXPERIENCE,
and the only thing holding it back was the sheer 100% lazy incompetence of the attempted fraud in question.

A metaphor for the administration at large. This has to come to an end and people need to pick a side:
Competence, or malice. Incompetence so complete and total is no longer plausible. This is intent.

It is small-t treason.

In response to the original question, squid meat is tough as hell so of course.

AlejandroDecember 17, 2017 8:54 PM

Here are instructions on how to crack a 4 digit wheel lock in about one minute, with no tools whatsoever:

Here is a youtube video on how to open virtually every keyed Master lock in the world with a brass hammer, within seconds:

My point:

All you got to do is ask google. I am sure cracking computers with seemingly iron clad security is as easy as breaking these locks anymore largely in part due to knowledge spreading all over the world instantaneously for billions of us to see and use.

What if there were urls to crack computers like cracking mechanical locks on youtube?

I think there is, don't you?

Just for educational purposes, google, "how to remotely install secret keylogger on computer".

AlejandroDecember 17, 2017 9:05 PM

Here are instructions on how to crack a 4 digit wheel lock in about one minute, with no tools whatsoever:

Here is a youtube video on how to open virtually every key Master lock in the world with a brass hammer, within seconds:

My point:

All you got to do is ask google. I am sure cracking computers with seemingly iron clad security is as easy as breaking these locks anymore largely in part due to knwoledge spreading all over the world instantaneously for billions of us to see and use.

What if there were urls to crack computers like cracking mechanical locks on youtube?

I think there is, don't you?

AlejandroDecember 17, 2017 9:13 PM


Re: Moxie and Signal.

Isn't Signal's end to end encryption rock solid and invincible?

You lost me.

ps: There is no way Bitcoin can survive the intense pressure it's getting. If nothing else, it was not designed to take the amount on traffic it's getting these days. It's doomed, no doubt.

RachelDecember 18, 2017 4:44 AM


thanks for Moxie Cryptomess article.
where to begin? i had multiple physical contractions at critical points in the narrative. i suspect we'll be hearing more - sounds a bit premature.
it concerns me, something ominous about it.
in many regards its worse its Moxie than some deadbeat celebrity

RachelrDecember 18, 2017 4:53 AM

a pleasure to hear you are out and about having a drink in venerable members clubs. You would belong to those that would have you as a member ? ;-)

Attribution : legal levels of proof. That is so damn quotable
I liked your post about the acoustic side channels and being able to tell how the particles were behaving.
reminded me of a backyard mechanic in the countryside, mates rates. i'd pull into the driveway and he'd walk out giving me the diagnosis barely before I'd gotten out - because of the sound. totally eerie!

65535December 18, 2017 5:06 AM

@ Clive R.

“Hey that's the Japanese just giving a little friendly competition...”

Sure… if you say so.

As the F35 cost so much, we should just buy the Chinese or Japans version as the price goes down.

Btw, how are the odds in the UK on those two legal cases I mentioned - the UK bookies seem to make odds on almost everything.

Who?December 18, 2017 6:03 AM

@ Clive Robinson

This is an old chestnut, which you normaly find in the claims of "Snake Oil crypto algorithm sellers". The fact that nobody has found anything does not mean it is difficult / impossible to find, more likely it means nobody has been bothered to look...

Are we sure nobody has found it? There are too many cases in the IC of bugs found and stocked for future use. Why not backdoors?

RatioDecember 18, 2017 6:14 AM

@Bong-Smoking Primitive Monkey-Brained Spook,

You made it, huh? ;-)   There was a tiny detour in the big blue room; I'll get back to yad.

RachelDecember 18, 2017 6:39 AM

Primitive Monkey Brain Spook

welcome again.
I can see you hold a depth of feeling for your beloved Ratio. ( I saw your poster)

Clive RobinsonDecember 18, 2017 7:30 AM

@ Anonymous2c,

Is Calibre still considered a good way to remove DRM from Amazon books?

It's not the DRM I care about it's the bl@@dy SpyWare it contains.

The IP stealers like Amazon use DRM as an excuse to commit all sorts of excesses and hide them behind the DMCA.

They are without doubt moraly lower than a snakes nads in a wheel rut at the bottom of Death Valley, and those that run it should be staked out on vulrure watch next to said wheel rut ;-)

Clive RobinsonDecember 18, 2017 7:54 AM

@ Alejandro,

Isn't Signal's end to end encryption rock solid and invincible?

Who knows or cares, when you can just walk around it with a simple hack?

I keep saying this[1] but, If your security end point is before the attackers communications end point then without very specialised hardware and software techniques you have no real security...

I would expect Moxie Marlinspike to be more than aware of this problem, so he is in effect selling Snake Oil when he talks about the security of the application.

Oh of the other version of Moxie's work, one of the senior people in Blackwater was heard to comment "What security..." about it.

The only people fooling themselves about it's security is the users, who either can not think technically or do not have access to basic technical information.

After all our host @Bruce has blogged and written into atleast a couple of books, as have Ross j. Anderson, Moti Yung and several others about "The weakest link in the chain" when it comes to security systems, and it's oh so very rare that it's the crypto algorithms.

Even the NSA's chief Scientist Bob Morris made it clear that the NSA went after "plaintext" first.

1, Plaintext.
2, Implementations.
3, Protocols.
4, Standards.

Are the main areas they go for before they even think of Crypto Analysis.

With consumer devices the SigInt agencies in nearly every First World Nation, do not need to go to second base. In part because the FiveEyes stiched uo the protocold and standards years ago... Do you think that Dual EC was their first attempt at "finessing" or just their worst so far, because they got first lazy then compleatly incompetent and sent a socialy inept idiot[2] in to the NIST technical committee?

[1] Searc this site for "end run" attacks and you will find I've been saying it for more years than I care to remember.

[2] There is no need for me to name the person, you can google it in about five minutes top. I guess however it will be interesting to google their career from now onwards just to see how further they rise, as that level of incompetence usually gets rewarded.

Clive RobinsonDecember 18, 2017 8:00 AM


I ain't dead, I was on a secret mission. What you read in the past was fake news and nasty rumors.

You been reading Terry Pratchett again "I ain't dead" featured in quite a few of his books and plot lines...

As it's getting to that time of year when Sox are tradditionaly given, I'm gessing you don't need wool, but something hypoallergenic to stop the itching?

Clive RobinsonDecember 18, 2017 8:07 AM

@ Rachel,

a pleasure to hear you are out and about having a drink in venerable members clubs. You would belong to those that would have you as a member ? ;-)

Well I make the occasional exception... As Buzz Aldrin said to me when we chatted briefly about the use of the Hasalblads, the most important thing in photography as it is in many things in life is not the small faults and failures, but,

Location Location Location


Clive RobinsonDecember 18, 2017 8:23 AM

@ 65535,

My brain is somewhat lacking since being out of hospital, can you refresh me with a link to your original question(s) of the court cases?

@ Who?

Are we sure nobody has found it?

No, but in the open community bragging rights usually come with publication... As for the "Not Socialy Adept" and their "Geriatric Chamber of Hapless Quibblers" friends they encorage the Never Say Anything policy in the lower ranks by the old tried and tested idea that in general they don't want to be sacked, made bankrupt, jailed and denied their pension and any prospect of reasonable employment ever again.

Clive RobinsonDecember 18, 2017 10:11 AM

Facebook fess up to mental harm but...

On the front page of UK Newspaper "The Times" the banner article is about mental health and Facebooks social media.

The first paragraph says,

    Facebook has finally conceded that social media can harm mental health but it proposed that users improve their wellbeing by posting more updates and comments.

I shall resist the "Only in the US..." urge and make an observation. When dealing with other habbits that seriously effect mental health and thus have wider issues, the medical advice where possible is "abstinence".

That is if you are an alcoholic you are told "You have to stop drinking". Even with people who are morbidly obese they are told "You have to stop eating X,Y,Z" (as you have to eat something to survive).

Facebook and social media in general falls in the former not latter category. That is you usually stop social media dead and not come to any serious health issues (other than withdrawals).

The massively "self interested" view point from Facebook is like a drug dealer suggesting you go for cocaine rather than crack... As they help thrmself to even more profit from extracting data from your postings...

I guess some Silicon Valley walnut corridor managment realy have less morals than those teenager's pushing smack onto younger children so they can get their own fix as a slice of the action...

bttbDecember 18, 2017 10:46 AM

from the Matt Blaze election thread

Roger Stone, recently in the news, the guy with a tattoo of Nixon's face on his back, or something, Manafort's former or current partner, may have been involved with that Florida 2000 election recount.
Fascinating- "Former high-level officials submit 'unusual' Russia brief in lawsuit against Trump and Roger Stone"

Bob PaddockDecember 18, 2017 11:34 AM

The American Hospital Association wrote in a letter to the FDA, dated December 7th 2017, amoung other attack statistics:


Hospital and health system leaders recognize that data held by health care organizations is highly sensitive, as well as valuable, and are taking cybersecurity challenges extremely seriously. The vast majority of hospitals already are taking many important security steps to safeguard data while they continue to enhance their data protection capabilities (details on the steps hospitals are taking can be found at

However, the recent global ransomware attack underscores the cybersecurity risks hospitals and health systems face and the importance of strong cybersecurity protections. More than 200,000 computers in more than 150 countries were infected with the WannaCry ransomware worm, which locked down systems and demanded a ransom payment to have them restored. While this attack was waged against all sectors, the health sector drew attention from the media and federal officials because of the critical nature of the services we provide and the widespread impact of the attack on the United Kingdom’s National Health Service. There are reports that WannaCry hit some American hospitals and health systems – and medical devices with embedded, outdated software likely were the vector.

Thus, this recent ransomware attack highlighted the extent to which medical devices are vulnerable and can create high-risk areas for the security of hospitals’ overall information systems. The FDA must provide greater oversight of medical device manufacturers with respect to the security of their products. Manufacturers must be held accountable to proactively minimize risk and continue updating and patching devices as new intelligence and threats emerge. They share responsibility for safeguarding confidentiality of patient data, maintaining data integrity and assuring the continued availability of the device itself. While the FDA has released both pre- and post-market guidance to device manufacturers on how to secure systems, the device manufacturers have yet to resolve concerns, particularly for the large number of legacy devices still in use.

Moreover, AHA members report that many manufacturers were slow to provide needed information about their products during the WannaCry attack. This includes information on the software components embedded in devices, the existence of vulnerabilities and the availability of patches. Furthermore, the mitigating steps recommended by manufacturers – such as taking a device off-line, putting it behind a firewall or further segmenting the network – had significant, and sometimes expensive, operational or patient care impacts. We recommend that the FDA proactively set clear measurable expectations for manufacturers before incidents and play a more active role during cybersecurity attacks. This active role could include, for example, issuing guidance to manufacturers outlining the expectations for supporting their customers to secure their products." ...

albertDecember 18, 2017 1:08 PM

Sensitive, are we?

I hear you, brother, but it's not all peaches, cream, and honey here in the Colonies, either.
So let us hoist a cold one, as Fellow Travelers on this Alien Landscape. Make mine sarsaparilla (with a dash of cherry).

We're in the same boat brother,
We're in the same boat brother,
And if you shake one end, you're gonna rock the other,
We're in the same boat brother..." - Leadbelly

. .. . .. --- ....

hmmDecember 18, 2017 1:18 PM

Anyone notice the recent admissions that cell phones DO CAUSE CANCERS? (!!!!!!!)

Phones are in every toddler's hand before pencils, and only NOW do they admit what many have known and a few have actually proven FOR DECADES ALREADY: Your pain is their production cycle.

Nicotine. Pthalates. Dioxin. Chrome 6. Saccharin. Aspartame. Fracking. Glyphosate.

Really this list is just about endless - and proprietary, and legally protected like Ft. Knox.

Today, Exxon Corp LITERALLY RUNS our government's related policy. Monsanto is in every gut, right now.
You can't escape. The arctic is open to drilling, the rivers are open to mining dumps, the oceans...
are completely f*cked. Landfills have become sea-fills.

This is the seventh major extinction event, and the most rapid in geologic history that we know of.

We are doomed - and even worse, why? Because some sociopath decided your death has profit for them.
They have rationalized that the death of all of us is a cost basis they can write off.

You can make all kinds of rationalizations on "better living through chemistry" but the people implying that we "simply cannot" have technology or innovation or new products without the inherent risk to our very health or sustainability as a society... those people need to be hanged by treasonous toe and drowned in RoundUp.

Because they swear it's safe. Because they swear renewable power is inviable, that only gasoline can power industry, that only fracking can save American jobs, that only toxins can make life convenient or worth living. That profit is a goal unto itself, and a death serving it is a life well ended.

"Stop stifling innovation with regulation" - cries the cancer as it metastatizes.
"Profit at all cost, to your last breath, until there are no more breaths to exploit."

This world is run by morons, I'm set to leave it soon as a direct result. (not by choice)

But - to those sticking around, you had best get your act together unless you want to end up a baseball glove or in a mcdonalds hamburger. You have no value to them until you are harvested, captivated, under contract, addicted, enslaved, and believing that their new innovation or wonder drug or AI will save you. It won't. They're just buying time. Yours.

Stop selling it off.

Anonymous2bDecember 18, 2017 5:26 PM

"At risk of enraging those who consider CNN's breathless 24-hour feed a greater threat" ...

I wanted to get a conservative take on the "Peterson youtube thing".

I searched DuckDuckGo for
1) "wall street journal matthew spencer peterson senate judiciary committee youtube"
and, separately,
2) "washington times matthew spencer peterson senate judiciary committee youtube"

and got no hits on page one from either The Wall Street Journal or The Washington Times.

I found it sad that with the shrill voices on both sides of the aisle that neither newspaper weighed in.

Somewhat non-MSM links that did turn-up included

ps. ianal, but you might go easy on the word traitor, or at least check out if it applies or choose another word.
From Wikipedia, I couldn't access Black's Law Dictionary,
"A traitor is a person who commits treason."
and from Wikipedia, treason in the USA
"Treason against the United States, shall consist only in levying War against them, or in adhering to their Enemies, giving them Aid and Comfort. No Person shall be convicted of Treason unless on the Testimony of two Witnesses to the same overt Act, or on Confession in open Court.

The Congress shall have Power to declare the Punishment of Treason, but no Attainder of Treason shall work Corruption of Blood, or Forfeiture except during the Life of the Person attainted."
" the United States Code at 18 U.S.C. § 2381 states:

Whoever, owing allegiance to the United States, levies war against them or adheres to their enemies, giving them aid and comfort within the United States or elsewhere, is guilty of treason and shall suffer death, or shall be imprisoned not less than five years and fined under this title but not less than $10,000; and shall be incapable of holding any office under the United States.

The requirement of testimony of two witnesses was inherited from the British Treason Act 1695.

However, Congress has passed laws creating related offenses that punish conduct that undermines the government or the national security, such as sedition in the 1798 Alien and Sedition Acts, or espionage and sedition in the Espionage Act of 1917, which do not require the testimony of two witnesses and have a much broader definition than Article Three treason. Some of these laws are still in effect. Some well-known spies have been convicted of espionage rather than treason, such as Julius and Ethel Rosenberg."

Anonymous2bDecember 18, 2017 6:02 PM

I assume the Federal tax package will pass in the USA this week.

Perhaps now is the time to write or call Congress if your interests are inconsistent with the tax package's interests.

Granted the lobbyists largely control both parties.

Perhaps 50,000 or 60,000 calls, faxes, and emails flooding in to each congressional office opposing the tax package over the next few days could have an effect.

Bong-Smoking Primitive Monkey-Brained SpookDecember 18, 2017 6:12 PM


You made it, huh? ;-)

That's the Rumor. You saved my life. I'll try to be nice to you, but force of habit might overtake me.


I can see you hold a depth of feeling

Yay high.

@Clive Robinson,

but something hypoallergenic to stop the itching?

You're playing with Fire. I'm itching to get even, you almost killed me with friendly fire ;)

ThothDecember 18, 2017 10:04 PM

@Clive Robinson

Re: Intel SGX / MobileCoin Snake Oil

Let's take a look at Intel SGX download page (

Before you enter the site, you might want to boot a CD-ROM OS image with web browser and with Internet connection from a non-Intel ME-ed machine if you want to.

So once you enter the download page, scroll down to ....

"If your system does not have the latest version of Intel® Management Engine (Intel® ME), you will need to install it.

Intel® ME Software for Windows"

Why in the world would anyone need to install Intel ME to get Intel SGX ? Hmmm .... oh wait it says 'Tools and Utilities section'. Hmmm .... :) .

How about development aspects for Intel SGX ? Here is the EULA FAQ (

Licensing Agreement page (

License Agreement Text (

Also you need a Commercial License EULA for those who want to develop production grade enclaves. Those 'debug/experimental' enclaves that have not signed an agreement with Intel will have debug mode place on the Enclave and one may step into the Enclave and pull contents out (hence debug mode) which defeats purpose of having an Enclave protected execution anyway.

In simple, it's a pain to develop and open source or even closed source for a production grade is terrible. I have contemplated on developing closed source Enclaves as part of a customization service package for my clients but I have rejected their requests as the amount of work is simply too much work and we had to look for a workaround on multiple occassions.

Also, take your time to read the License Agreement text. Nasty legal stuff all over. A legal minefield to put it simply and you would need an experienced attorney to guide you through and explain them to your devs if you want to do SGX development work.

Can the production grade Enclave application be truely open sourced without violating NDA bindings in the SLA text above ? It's going to be very hard and so far I have not really seen open sourced production grade Enclave applications yet unless I am missing something.

So back to the whole thing. Is it going to work via being Open Source and the nice goodies that was associated with Signal ? Unlikely due to the SLA for production grade Enclave applications.

@Nick P

Intel SGX development with Rust Lang


65535December 18, 2017 11:22 PM

@ Clive R.

Hospitals are not fun. Been there dieing but survived. Not a good place to land in.

The two possibly game changing legal cases climbing the legal pole which includes one Bruce S. our host signed on in a brief.

Here are the two important cases, one is mass police spying case and the second is National Security invoked case on petty crimes:

1] "Carpenter v. United States is a pending case before the United States Supreme Court and raises the question of whether the government violates the Fourth Amendment to the United States Constitution by accessing an individual’s historical cell phone locations records without a warrant. The Supreme Court heard oral arguments on Wednesday, November 29, 2017." Wikipedia, Bruce S. signed a brief in that case.


2] "EFF and ACLU File Ninth Circuit Amicus Brief in U.S. v. Keith Gartenlaub… February 15, 2017, United States v. Keith Gartenlaub 16-50339 (9th Cir.) In 2014, the FBI, incorrectly suspecting Mr. Gartenlaub of being a Chinese spy, obtained a warrant from the Foreign Intelligence Surveillance Court (“FISC”) and searched his computers [Imageing the hard drives while he was not home- ed]. The search turned up no evidence of espionage. It did turn up a handful of child pornography files. The evidence at trial, however, never established that Mr. Gartenlaub ever viewed the files and was entirely consistent with someone else placing them on his computer a used and old computer-ed]."-Torekeland


Clive RobinsonDecember 19, 2017 12:59 AM


You're playing with Fire. I'm itching to get even, you almost killed me with friendly fire ;)

Is that the sort of fire that crackles gently in it's place/grate, providing a warm glow of heat and light, that generaly gives a feeling of peace and contentment in those that are close to it?

Untill of cause the chimney explodes in a ball of fire and destruction because you forgot to sweep out your flu?

Speaking of which, you possibly know that in the UK we used to make our chimneys large enough to send small children up? Where as in the US having a shortage of children they came up with a different solution...

Blacksmiths made a contraption that looked vaguely like a large pair of scissors, that had turned over tips and small cannon balls where the handles would be. Around thanksgiving time you went and caught a wild turkey in a net or other "keep it alive" trap. You then set up ladders or equivalent up to your chimney top.

As some will know the wild turkey whilst mainly ground dwelling can sort of fly in a very frenetic fashion given enough provication, oh and it's a fairly mean and vengeful beast if you do provoke it, as it's beak and claws have a lot of muscle behind them and a short fuse brain that sees most things including potential mates as either food or a provocation.

Thus having caught your wrestling companion and subdued it by wraping it in a blanket or strong cloth that keeps out light, you then tie each foot of the wild turkey to one of the turned over tips and keep it wrapped untill you get it up to the chimney. Where you would put the cannon ball end into the top of the chimney and carefully unwrap the wild turkey which would start flapping like crazy to escape. However the weight of the contraption you have just let go of would drag it down and it would flap even harder to escape. The final result would be the contraption reaching the fire place with the wild turkey still flapping like mad, oh and god alone knows how much soot from the chimney the turkey had dislodged on the way down...

As for the fate of the wild turkey, I'm guessing that it would be heading for the pot, after all it would be easier to just shoot it than try wrestling it back in the cloth/blanket and out the door.

So are we going to see a match between a wild turkey and BSPMBS?

P.S. You know BS PM BS can be read entirely differently in the UK with first BS reading as British Separatist, PM as Prime Minister and the second BS retaining it's more normal meaning ;-)

Bong-Smoking Primitive Monkey-Brained SpookDecember 19, 2017 2:16 AM

@Clive Robinson,

So are we going to see a match between a wild turkey and BSPMBS?

Strange you mention that! I just got a 20lb turkey to cook on a misquote grill. My favorite way of cooking it. The fire does crackle too! As for the fight, it could potentially happen between BS PM BS and his god father's seasonal gaiter. Only time will tell ;)

You know BS PM BS can be read entirely differently in the UK

I thought about that but not from a UK perspective, though I like your charming contraction/decomposition/recomposition of the letters. Kinda like encrypt/decrypt/encrypt in 3DES, but in a twisted way :-)


soot from the chimney the turkey had dislodged on the way down...

The turkey eats soot for breakfast, or rather inhales it. I wouldn't worry too much about that!

Clive RobinsonDecember 19, 2017 2:49 AM

@ Thoth, Nick P,

Why in the world would anyone need to install Intel ME to get Intel SGX ? Hmmm .... oh wait it says 'Tools and Utilities section'. Hmmm .... :) .

Yes how curious...

I can not say for certain but if you follow a little logical progression ;-)

1, Intel SGX supposadly allows user-level code to allocate private regions of memory, or "enclaves".

2, In theory, enclaves are protected from processes running at higher privilege levels.

3, However Intel ME is supposed to be not only above such considerations privilege wise, but also beneath any such considerations via direct memory access.

Thus I can only surmise that Intel ME can do whatever it likes with an enclave, which does not bode well with DRM insisting types. Or for that matter the IC entities who wanted to turn ME hard off.

As Intel screwed up big, --not for the first-- time over ME and the fact that you could get access to it fairly easily...

Thus my guess would be that the ME upgrade is about to be come a requirment for everyone outside of a few select government entities, as Intel "papers over it's cracks...

Personally I see every reason not to trust Intel or other CPU manufacturer who adds the equivalent of ME to their products, it is at it's simplest a significant backdoor into a system, robbing you of the rights and privileges of ownership of the very expensive CPU. Thus you don't own it, you can not trust it, therefore you should not use it.

I've mentioned ways to mitigate such a disaster using low power CPUs. Thoth, you likewise have mentioned using SIM cards as a method. There is however another way which Nick P has investigated which is to develop your own CPU based around the RISC V or similar open design. I can see quite a few countries going down one or more of these routes as a couple of non US Super Powers have already done.

If people do go down the Open Design CPU route, I would suggest they also add a suitably large FPGA to it, as this seams to be the next logical pathway.

ThothDecember 19, 2017 3:16 AM

@Clive Robinson

I wouldn't want to bet on RISC V anytime soon. They have a goal to be used in smart cards and TPMs by adding tamoer resist mechanisms and that is enough to be worried.

Traditionlly, the hardware security industry with it's tamper resist and hardware backed security have always been hush hush with designs and they will point to NIST FIPS 140 PUB docs and CC docs as specs that require gag orders.

I don't know when they will be coerced by powerful corps and govts who dont wish the masses to have open design secure compute modules but I have a very very very very bad feeling if they are not tainted, it is a matter of time only. I am not trying to piss people off by dashing anyone's hopes but let's face the facts, most of the fabs are controlled by powerful corps or govts in a way and they have their agenda. The govts have been pushing for hardware backed backdoors.

The more one tries to design a specific product or design for a specific purpose that the powers that be deem os bad for social control, the more they want to interfere. Esoecially designs like RISC V that is suppose to inject new hopes into an open design thus theoretically removing control of govts and passing the freedom and power of computing back to the people, what is the likelihood it would fly pass under their radars and allowed to exists untouched ?

I am somewhat mostly skeptical and cautious but also a little optimistic if it ever makes it out of possible political, legal and technological storms alive and clean.

CassandraDecember 19, 2017 7:58 AM


You are playing from my songbook, although company is always welcome.

Unless and until a collection of 'big enough' nation states that control their own foundries realise the benefits of an open, secure processor - possibly somewhere like Brazil and one or two others, so that independent validation and production of designs can be performed.

I would not be surprised to find independent foundries subject to subtle and not-so-subtle sabotage attempts, like the subversion of Swiss (Crypto AG) cryptographic equipment sold to the world:

BBC: How NSA and GCHQ spied on the Cold War world; Gordon Corera Security correspondent, BBC News; 28 July 2015

Le Temps: Depuis 1956, l’entreprise suisse Crypto AG collaborait avec le renseignement américain, britannique et allemand; Mehdi Atmani; 28 July 2015

Baltimore Sun: RIGGING THE GAME No Such Agency; Scott Shane & Tom Bowman; 10 December 1995

It is also worth remembering that peripheral equipment with Direct Memory Access can also cause problems. Network Interfaces, Graphics Processing Units, etc can have their own processors and operating systems with full access to a processor's main memory. You can understand why some people might want a secure on-die enclave segregated from main memory and buses. The CPU may be open and secure, but if the NIC, GPU, or Broadband Modem, or even the keyboard have been subverted, you have not made anything other than illusory gain. Clive's air-gapped processes with data-diodes etc. are necessary, but woefully rare.

This is all very familiar to regular readers of this blog, but it is always worth re-capping for new readers.


Clive RobinsonDecember 19, 2017 9:27 AM


I just got a 20lb turkey to cook on a misquote grill.

Hmmm, you be careful with them "misquotes" they may burn your ears.., but cook your food not... Just one reason why spell checkers can make your life raw/unpalatable ;-)

But more seriously be carefull with mesquite wood it has real issues. Not only is it a hard wood that burns very hot, for the same reason it produces way way more smoke thus creosote[1] than many foods can take, thus end up tasting like you cooked over sappy pine and brown coal :*)

The trick I used to use was to use "chips and charcoal". You cook with the charcoal to give good controlable cooking heat and use a few small chips of various woods in a smoke tray to give the right levels of soft and hard smokes for the flavour you want.

I like apple and pear wood for soft smoke for the likes of cold smoking cheeses and fish, and other woods like hazel to give other notes for fowl and some game and pork that are medium smoked. Reserving the hard smokes either for a final hit or for the likes of mutton, goat and various leg beefs you "hot smoke" but over time[2].

It appears I'm not the only one to be a bit cautious about mesquite, apparently a lot of Texas barbeque pit joints are as well,

I realy don't like cooking turkey I find it is just not worth the effort, it lacks fat and flavour and drys out as fast as it cooks, which means you have to add lardons or other sorces of fat and flavour like herb butters prior and during cooking... I usually cheat and effectively inject the bird with fat wrap it realy tight in tin foil and steam cook it slowly, if I want a smoky flavour I add liquid smoke to the fat mixture. I only unwrap it and brown it off towards the end in a hot dry oven that you've already started doing the roasties in.

So take care with the broiling / barbeque / smoking.

[1] It's actually the creasote that contains all sorts of interesting mainly poisonous chemicals that give not just the flavour to smoked foods but causes the chimney and flue fires that can be explosive, fatal or both,

[2] Don't waste the smoke that goes up the chimney/flue... Ever hear of "liquid smoke"? It's actually not difficult to make. You need a small "smoke box" and large "water trap" and a way to draw gently on things. You can make the smoke box out of an old steel can with a press fit or screw top lid. It may need one or two small "draw holes" you can cover to alow just enough air flow. This container has the flavour wood put in it and heat from outside the can. The flavour wood will if you heat the can long enough will eventually reduce down to charcoal if you do things right. From the lid of the can you need an air tight flue, that goes into the water trap input where it bubbles through the water and will turn it into liquid smoke. The output from the water trap needs a suction or draw system to ensure the smoke goes through the water trap. CAUTION the output from the water trap is "town gas" which is a mixture of the inert air components carbon monoxide and a little hydrogen, you should "burn this off" as it has almost the same volumetric weight as air and thus will not rise if cold. In industrial systems where they turned peat or other bio mass into oils and creasotes, the town gas was either fed back to heat the "smoke box" or piped off to peoples house for cooking and lighting. If you are producing a lot of town gas then you have to much heat on the smoke box and your liquid smoke will not taste right and if you go into making charcoal you will not get as much as you expect as it will make more carbon monoxide than charcoal.

Clive RobinsonDecember 19, 2017 10:19 AM

@ Cassie,

You are playing from my songbook, although company is always welcome.

As the old saw has it,

    Misery loves company

So you might get the "usual suspects" into a little choir, with @Bruce on the drums ;-)

I can do a passable baritone when suitably libated, I find a good tea with crumpets suffices at this time of the year, prior to going door to door with a Carol or two (their such lovely twins -- sorry had to slip that old joke in it's better than the "stocking filler" line ;-)

Bong-Smoking Primitive Monkey-Brained SpookDecember 19, 2017 10:56 AM

@Clive Robinson,

Hmmm, you be careful with them "misquotes" they may burn your ears... reason why spell checkers can make your life raw/unpalatable ;-)

You're right. Damn spell checkers!

Not only is it a hard wood that burns very hot...

Correct, and last a lot longer too! Suitable for a turkey that takes 4 - 5 hours! This is what I use.

The trick I used to use was to use "chips and charcoal".

I used that trick a while back. Here are the steps for my way:

Step 1: Make an oval stack of coal, can put a pan with water in there middle. Light it up.
Step 2: Once the coal is well-lit, place the wire mesh grill
Step 3: Wash the bird and place it thusly.
Step 4: Cover the grill, and close the air control holes about 75%. Adjust to your conditions.
Step 5: After a few hours, you may need to add more coal. Make sure you light it up before you put it on the grill. Prepare it 30 minutes before you need it. Notice the time of day? That was a few hours later.
Step 6: Almost done! Yummy :)
Step 6: Perfection!
Step 7: Umm.. more perfection. goddamn! after all this work! Still tests good ;)

A different day, a different idea... If you like it, then I'll tell you how to cook turkey necks next. Simply Devine.

CallMeLateForSupperDecember 19, 2017 12:43 PM

Breaking news: "Too Many People Are Still Using 'password' As a Password"
List of most-common passwords for 2017, according to Splashdata (via Motherboard).

I am shocked. Shocked, I tell you!

Also skeptical of such reports, both past and current, because much of the raw data is very likely years old. That said, it was nostalgic to see old friends from the creaky old RockYou list in this story: "12345"; "letmein"[1]; "qwerty";"passw0rd".

[1] My eyes always read "let mein" instead of "let me in", indicating that a little knowledge of Deutsch can be too much. ;-)

Sancho_PDecember 19, 2017 3:51 PM

@Anonymous2b wants us to write or call Congress re tax package:

“Granted the lobbyists largely control both parties. Perhaps 50,000 or 60,000 calls, faxes, and emails flooding in to each congressional office opposing the tax package over the next few days could have an effect.”

“could have” - Yes.
I’m afraid the lobbyists do that already using bots, some of them on the opposite side, pretending “the Russians did it” just to get the simple minded onto their wagon and to ridicule the whole petitioning.

Um, didn’t that happen ‘yesterday with NN?
Wait until they realize that webcams / IoT can send email, too …

Sancho_PDecember 19, 2017 3:57 PM

@65535 re Keith Gartenlaub’s (child porn) case

The point isn’t that they inadvertently (?) found CP on the HD.
Imagine a search warrant for drugs (not found) but encountering a dead body in the cellar.
Should police walk away because they were not allowed to find the body? Because “Plain view” is ‘verboten’? Bullsh …

But the Gartenlaub case is (intentionally?) based on a wrong premise.
Neither FISC nor the 4th are involved.

The point is: What they found is not evidence because intangible information on a single PC (which is per definition not a secure device, see lex Bill = EULA)
must not be acceptable evidence in court.

There is no proof of origin or whatsoever so it must be dismissed.

A PC user can not know what is stored on the HD, it’s too complex.
Even for the dead body in the cellar there must be other evidence to make the suspect the murder.
Btw: Is there a law saying you must not have a dead body in your cellar?

The Gartenlaub case would consent to PC-content being “evidence”.
That’s completely wrong.
It may be used as a hint, not more.

Clearly the whole issue is used to finally legalize any FISC abuse.
Bad attempt.
Very sad discussion.

Clive RobinsonDecember 19, 2017 5:29 PM

@ Sancho_P,

Btw: Is there a law saying you must not have a dead body in your cellar?

In the UK there is no such law, there are regulations as to how a deceased person is prepared / buried and about legal paperwork, but that's about it.

So there realy is no reason why you can not put the wife/husband parents etc "under the patio" or "down the cellar". Though what it will do to the property price is another thing.

Oh and the reason I know, is I've looked into being buried rather than cremated. In London if you go into a cemetery they have the right to dissenter you almost at will for any number of reasons neither you or your relatives can stop. They can even throw a few old bodies in the hole before they pop you in on top...

However with a "home burial" it's going to be significantly less costly as technically only a shroud is needed it's also way more environmentally friendly. Importantly you personaly set the rules in various ways in your deeds of property and will etc. That if you do it right can not be changed except by significant act of parliment (which is likely to be too contentious for the next hundred years or so).

hmmDecember 19, 2017 8:07 PM

"Damn spell checkers!"

Well stop using them to stress test your CPU, Clive!

Doesn't your browser ever get tired of drawing red lines under everything?

Bong-Smoking Primitive Monkey-Brained SpookDecember 19, 2017 8:35 PM


Well stop using them to stress test your CPU, Clive!

Ain't attribution a b*tch!

65535December 19, 2017 9:05 PM

@ Sancho_P

I am not quite sure what you intended to say:

“But the Gartenlaub case is (intentionally?) based on a wrong premise.
Neither FISC nor the 4th are involved…Clearly the whole issue is used to finally legalize any FISC abuse.Bad attempt.”-Sancho_P

I guess you are saying that the police are trying to legalize the use of a secret and sealed order to hunt for low level criminals. Am I close?

‘Federal prosecutors in Gartenlaub’s case insist that they followed the law. “The issue of the FISA warrant was the subject of an extensive pre¬trial briefing… a spokesman for the U.S. attorney’s office in Los Angeles.’- Washington Post

I appears to me that the porn case was caused by the initial FISA warrant to secretly search Gartenlaub’s house and computers, and then the cops applied for another warrant in court. Now, there is a secret meeting with the judge and prosecutors without the defendant’s lawyer being present. Is the point you are trying to get across?

“‘FISA Court's Secrecy Threatens to Subsume Our Open Court System’ Keith Gartenlaub seemed like he'd be the first person to challenge secret FISA court surveillance. Then an appeals court had a secret meeting with the government's lawyers….FBI conducted the search in question—a sneak and peek search of his home over several days, during which a number of computer devices were secretly imaged—under FISA’s physical search provision, not the better known Section 702. But because it pertains to the use of data collected under FISA for criminal prosecutions, any decision in this case might affect back door searches currently conducted under that statute as well.”-motherboard

I seems to me that the FISA Court was indeed very involved in the case.

RatioDecember 20, 2017 2:30 AM

@Bong-Smoking Primitive Monkey-Brained Spook,

I'll try to be nice to you, but force of habit might overtake me.

Be. Or be not. There is no try.

Use the force, Spook.

(That's all I got for yad for now.)

Bong-Smoking Primitive Monkey-Brained SpookDecember 20, 2017 3:30 AM


(That's all I got for yad for now.)

I hate it when a random person on the interwebz pisses in my bong and wastes one of my weekends, like he did to the other schmuck. You hear me, yad ya Ratio?

Clive RobinsonDecember 20, 2017 7:01 AM

@ 65535,

Had a look around and the two cases are not even blips in the noise in the UK media.

Which for various reasons is not that surprising as far as most of the MSM is concerned it's waiting for the "Blunder-bus" that is the next step of the Brexit process --that less and less people want daily-- to blow up yet again in an incompetent and increasingly unwanted governments face.

They MSM is way more hysterical than the technical press but even they are having "Brexit hot flushes",

Even the up coming Trump visit is pushed out of column inches by Brexit.

As for "The Russian Factor" that does not get a look in either...

So unless you like the thought of a bunch of greasy old Commissioners and Politicians wrestling over who can make the other side look more stupid and failing in that they all look bad then The UK is not the place for news.

Clive RobinsonDecember 20, 2017 7:24 AM

More IoT "you are owned"

2017 has not been a good year for Iot and to be honest I doubt things will be any better in 2018, in fact I 's but a couple of bob on it getting worse, potentially way worse, as Tech Toys with big bandwidth are proliferating.

So back to CVE-2017-17562 on a GoAhead IoT WebServer injection attack issue, The problem with GoAhrad pre-version 3.6.5 comes from the way it handles requests from browsers to CGI programs that generate dynamic webpages.

Put simply if your IoT device WebInterface is GoAhead and it can be seen by anyone with intent and you have a dynamically linked CGI program them you have probably got issues you realy do not want heading your way in time for Xmas...

Iot Security Step 1 : More or less dictates that all IoT be on it's own issolated network without any kind of Internet access. The reality is that most IoT pushes for Internet access...

vas pupDecember 20, 2017 8:16 AM

Vengeance is sweet and expensive:
"When we see somebody suffering, we normally feel uneasy and want to help. However, this feeling can be reversed. When we know someone behaved in an antisocial manner, we can remain unsympathetic even though we know they are hurt. It is known from previous studies that we perceive the perpetrator's pain as a just punishment and a tool to penalise misbehaviour. Moreover, we feel a sense of spite when we witness the disciplinary measure."
Looks like demand for justice is in our genes.

Bong-Smoking Primitive Monkey-Brained SpookDecember 20, 2017 8:37 AM

@vas pup,

"When we see somebody suffering, we normally feel uneasy and want to help.

Speak for yourself! It makes me feel good. If I saw someone drowning I'd think twice before throwing him a life saving device. In most likelihood I would choose this one. Who knows, it could be a TLA member or an attorney who would get nothing less than the royal treatment in addition.

bttbDecember 20, 2017 11:55 AM

North Korea in the news, yesterday, David Ignatius

"A senior U.N. envoy who visited Pyongyang this month carrying a pressing appeal for diplomacy was told by his North Korean hosts that it was “too early” for steps that might ease the confrontation over their nuclear program."

“There was no sense of urgency” among North Korean officials, said one source familiar with the Dec. 5 to 9 journey by Jeffrey Feltman, the U.N. undersecretary for political affairs and a former senior U.S. diplomat. His trip, which has received relatively little attention, was the first to Pyongyang by a high-level U.N. official in six years.""

From August on North Korea (video around 5 to 10 minutes; transcript too)

Missing footnote from
for the following quote:
"A conundrum: Today’s American soldier is by common consent the world’s finest, even history’s finest, but the United States doesn’t win its wars. Time and again, the mission – the overall aim of the exercise – goes unaccomplished, while the war itself continues as if on autopilot. Why?"

Bill Moyers from September

Rajan Menon from June

Also from September, Bacevich again

Some history on North Korea, from a book review
and Noam Chomsky on North Korea from April
Chomsky on North Korea & Iran: Historical Record Shows U.S. Favors Violence Over Diplomacy

bttbDecember 20, 2017 3:02 PM

On the light (not far) side. For non-native, or something, english speakers there used to be a series called The Far Side.

On to the placebo effect or something
"Unlocking the Healing Power of You
Science is showing that how you feel isn’t just about what you eat, or do, or think. It’s about what you believe."
"Mike Pauletich, during a trial at Stanford University, believed he had surgery to alleviate Parkinson’s symptoms. In fact he’d received a sham surgery—but he did feel significant relief. “Whether it was placebo or some effect of a drug,” he says, “it doesn’t matter to me.”"
This story appears in the December 2016 issue of National Geographic magazine.

Sancho_PDecember 20, 2017 6:14 PM

@65535 re Gartenlaub & Neither FISC nor the 4th are involved

What I wanted to say is that anybody (not just technicians) who is reading the news nowadays will agree that PCs are not secure devices.
From hardware to software the user doesn’t know what’s happening with the device, who owns it and who did what. Imagine that clicking a link might end in disaster, let alone to download and install “in good faith”.
Updates, often mandatory, are completely out of user control.

Only our lawmakers, LE, lawyers and courts don’t know?

(1) Whatever is found on an HD / PC might be strange, but neither evidence nor proof of a crime [1].
If it is the single indictment it must be dismissed.

(2) Let’s assume there is other circumstantial “evidence” but can’t be shown (because classified) then it must be dismissed (In dubio pro reo).

(3) If there is any circumstantial evidence admitted then
The defense must be able to examine evidence and to completely follow the chain of arguments.
All used procedures, systems and machines must be demonstrably certified to handle evidence for court.
Think of a certified institution to examine DNA or an appointed expert / official.
A PC running Excel together with a bunch of other unknown software, let alone Internet connection, is not fit for purpose. Also a standard production server running Linux is not certified for legal processing.
One could argue that failures are unlikely but that’s not enough to send someone to jail, especially when Terms & Conditions of HW and SW do not explicitly approve such use.
Again, such “evidence” can not be used to convict someone (In dubio pro reo).

Of course it is not ethical to use such “evidence” in plea bargaining, but because plea bargaining itself is extortion, a method you’d only expect from criminals.

They have ruined Gartenlaub's existence without having any proof.
The rest is speculation, like planting CP to extort C-17 info.
Yes, I have hinted to their attempt to rubberstamp classified (= we do as we do, stupid),
but my main point was and is:

PCs content is not secure, from HW to SW, and can’t be used as evidence in court.

@Clive Robinson replied to the legal question re dead body in the cellar.
Possession is not always a crime.
I’m not a friend of CP, but making possession of CP a crime in context of a PC is nonsense because possession means “control of” and that’s not the case with vulnerable computers.
Additionally there is the difference between tangible and intangible “possession”. It can’t be a crime to think of CP because it is inside the brain, invisible, intangible and no one knows who has put it in.

Anonymousa2CDecember 20, 2017 7:18 PM


"The defense must be able to examine evidence and to completely follow the chain of arguments."

Is this consistent with secret laws or secret interpretations of law?

ThothDecember 20, 2017 7:51 PM

@Bob Paddock

Many have tried and many have failed miserably on developing unhackable computers. For those who are experienced in the industry, the more conservative term of hacking resistant would be used instead of unhackable. Once someone uses an extreme term like 'unhackable' or 'tamper proof', it is either done by someone who doesn't know what they are into or done by someone deliberately and possibly can be considered a fraud especially when marketed to Governments.

WaelDecember 20, 2017 9:46 PM

@Winston Smith,

Formidable indeed....

Formidable against a crippled version of Stockfish, it would seem! Information needs to be made public and must be verifiable by independent reviewers.

Long time ago, when I wasted many hours on chess engines, I customized them to mimic personalities (Chessmaster, mainly) Morphy, Aliekhine, Capablanca... on other engines I tried: aggressive, solid defense, dynamic.... etc. the default setting at the highest level was always the strongest (I played engines against each other.)

I wonder if this version of Stockfish is customized.

tyrDecember 21, 2017 4:30 AM

@Bob Paddock,Thoth

The best way to hack an unhackable computer
is to be part of the developement team and
build it into the system.


One of these days I'd like to see a politician
that you would feel safe to allow to be alone
with your chickens.Every one of the current
marvels seems to lack a certain aplomb shall
we say.

As a cynic I think the National Security Act
of 1947 was a declaration of war on the whole
world by USA. I base this on observed actions.

Clive RobinsonDecember 21, 2017 5:13 AM

@ Bob Paddock,

So what is your hack for this machine?

There is insufficient information in the blurb to give a specific answer. That said I can tell you some of the things you need to think about when making a system hack-resistant, and you end up with the realisation that security is probabilistic in nature.

Modern computer systems work on having a very powerful compute engine and vast amounts of memory.

Whilst this is great for code cutters, it's even better for malware writers as it gives them lots of space and spare cycles to play with. Thus their comparatively small and efficient code hardly gets noticed in the noise of the code cutters inefficiencies and waste.

One way to get ride of some malware is not to give it any memory space to exist in. That is if there is no spare / free memory they are forced to change existing code. Often this is not a problem because with enough inefficiency by the code cutters, the malware can do tricks to tighten their code to make space for it's self. However that needs a certain minimum of space. It can also end up burning quite a few extra CPU cycles, thus changing the timing signiture of the executing code. The problem with hugh monolithic slabs of code is their time signitures are way to complex to easily analyse.

There is however another issue, of a bit of mathmatics from before Turing/Churches work in the 1930's. In essence it tells us that a computer can not tell you if it is running malware or not, because at the end of the day once malware is on the system it's routed and it does what the code tells it to do.

Thus there are three problem areas you can attack that will increase your ability to detect malware.

Firstly is to seperate out the CPU from main memory and give it the minimum access required for it to do a given task. The way to do this is with a piece of hardware that is usually used to do the opposite with "Virtual Memory" (VM) the "Memory Managment Unit" (MMU). The problem with this is that most MMUs are controled by the CPU so any malware on the CPU can change the MMU settings and you'ld mostly be none the wiser.

Thus the MMU has to be controlled not by the CPU but another mechanism designed to enforce security. Thus you end up with a second monitoring system or Hypervisor.

Thus you get a hierarchy of mechanisms, at the bottom the CPU's doing the required work. This is gated in behind an MMU controled by a hypervisor controled in turn by a supervisory system. Thus you have the makings of an effective system to limit the amount of main memory an individual CPU has access to.

The question then arises can such a system provide other functions. To which the answer is yes. You can have multiple work CPUs controlled in the same way. By applying the processes of "parallel programing" you can split the large monolithic slab of code down into smaller parts that run on multiple work CPUs. The reduction in code on any individual CPU reducess not just the complexity for the code cutters it makes any malware writers task more complex. But as each code unit becomes less complex it's operating signiture becomes more defined thus easier to monitor.

If you break the code down far enough you end up with "common function tasks" or tasklets with clearly defined signitures not just of execution but of values in locations of memory. Thus a hypervisor can monitor not just the expected timing signiture but by halting a CPU go and perform a check on the memory and see any changes.

A real upside of this is that the tasklets can be viewed like secure versions of the utilities that are used in rapid design via shell scripting.

From managments perspective having code cutters work at this higher programing level makes them not only more efficient it can make code reuse more effective.

But if you have a CPU for each tasklet, you end up with many CPUs that the hypervisor selects and assigns in some apparently random manner making a malware writers problem even more difficult. Thus it is like having address stack randomization on steroids and speed...

In essence this appears to be what the UoM have "re-invented"...

I can go into greater depths and other further security benifits. But I have talked about it in a lot of depth in the past on this blog for what feels like a decade under "Castel-v-Prison" or C-v-P.

As normal the industry is slowly catching up with what gets discussed on this blog and I find it hard to believe that with the frequency of such "re-invention" that in some cases it is more of a "Cut-n-Paste and quick rename", that would otherwise be called plagiarism...

Clive RobinsonDecember 21, 2017 6:03 AM

@ tyr, Bob Paddock, Thoth,

The best way to hack an unhackable computer is to be part of the developement team and build it into the system.

The mathmatics behind it says there is no way to defend against "a true insider attack" in any given system.

All it needs is for the person to be trusted and insufficiently audited and it's game over on that particular system.

The way to try to limit this is expensive which ever way you go. Eventually the cheapest route to go is to have N independent teams design N independent systems to run in parallel on the same problem at the same time[1]. Any difference in the output will point to an issue... Then all you have to do is find it, and there may not be enough time in the universe to do that...

Oh and their might not be an issue as such, because there is a probabilistic error in all "sampling systems" which all digital circuits are by design. It goes by the name of "metastability". You can mitigate it to an extent but never eliminate...

So what ever do you hit a recursion issue and "it's turtles all the way down".

So yes the Universe gets the last laugh every time.

Which is why you eventually realise that security at the end of the day is probabilistic in nature. So you might as well go with the flow...

[1] There is a problem still though, design teams need specifications to work from, if you write the specification, then if you are sufficiently clever you can "Hack the Spec" the independent teams all work from...

Nick PDecember 21, 2017 3:20 PM

@ All

Round 1 Submissions for Post-Quantum Cryptography

Remember my scheme was split secret between standard asymmetric, NTRU, and McEliece. Merkle Trees, too, where possible. I was playing it safe if not efficient. Some corroboration on McEliece choice: Bernstein's team is going all in on it. There's some other interesting things here.

I'd like to see some write-ups on some of these by long-time cryptographers like Bruce.

65535December 21, 2017 10:16 PM

@ Sancho_P

“What I wanted to say is that anybody (not just technicians) who is reading the news nowadays will agree that PCs are not secure devices…Updates, often mandatory, are completely out of user control…1) Whatever is found on an HD / PC might be strange, but neither evidence nor proof of a crime [1]. If it is the single indictment it must be dismissed… (3) If there is any circumstantial evidence admitted then a) The defense must be able to examine evidence and to completely follow the chain of arguments. b) All used procedures, systems and machines must be demonstrably certified to handle evidence for court.”- Sancho_P

I agree with you. I believe Emptywheel and others are highlighting the unethical nature of using NSA tools and tactics to hunt for Child Porn in this legal case. This could be an extreemly important case.

As Emptywheel notes, the Porn was never viewed or proved to be viewed. The computer and hard drives were secretly copied by the FBI while the defendant was out of his house. The evidence chain of custody was in doubt or not audited.

The FISA Court or possibly an FBI directives secretly sealed all evidence before the defense attorney had a chance to look at the evidence. Thus, there is a chance that the government is pressuring the defense or even using parallel construction to get a pornography charge against the defendant illegally.

This is an extreem abuse of NSA powers and the National Security Act - not to mention unethical tactics by local police.

“They have ruined Gartenlaub's existence without having any proof… my main point was and is: PCs content is not secure, from HW to SW, and can’t be used as evidence in court…making possession of CP a crime in context of a PC is nonsense because possession means “control of” and that’s not the case with vulnerable computers.”- Sancho_P

I also agree with those statements. The government is trying use the defendant's PC as evidence aginst him.

That is why the stakes are high. The outcome of this case could negatively affect the NSA/FBI/Police. If the defendant wins this case the NSA/FBI/Police will look corrupt and will probably be stripped of their use of such powerful legal weapons as hidden or sealed FISA court cases, sneak-and peak cloning of hard drives, closed door discussions with the local judges without the defense lawyer being present and generally look like criminals with a badge pinned to their chest.

This case could be extremely important to future legal cases for decades. I believe this is why there is a large amount of unethical activity upon the part of the Government. If the Government lose this case the lose a huge chunk of their spy police work and computer copying tactics.

I believe the case is worth following. But, only Emptywheel, the ACLU and Gartenlaub’s lawyer appear to be watching. This is bad.

65535December 21, 2017 10:21 PM

@ Clive Robinson

“…the two cases are not even blips in the noise in the UK media…the MSM is concerned it's waiting for the "Blunder-bus" that is the next step of the Brexit process…The UK is not the place for news.”

I understand what you are saying.

Unless, Trump dies instantly or there is a terror attack with automatic rifles or bombs then the “sensational factor” is not there. It is not news worthy.

Both legal cases could cause a significant change in legal rights of the accused if the cases are won – by the individual and not the NSA or GCHQ.

I wonder if the cases are down-played in the UK because they are not favorable to the government. As I understand, the BBC is funded by the UK upper class and mostly controlled by that class. But, lessor new outlets would probably not be -that is just a guess.

We shall have to wait for the US Supreme Court and/or the 9 th district court of appeals to make a some decision.

Clive RobinsonDecember 22, 2017 2:53 AM

Dell EMC SMBv1 overflow bug

Some of you have the "Delight" of running Dell EMC kit. Well CVE-2017-14385 affects it's "Data Domain Deduplication and Data Protection software" and is an issue with SMBv1 code that an attacker could exploit.

Essentialy they can excercise the bug by sending carefully crafted SMBv1 packets. Which can be used to trigger a memory overflow, that in turn could be used to execute arbitrary code... More obviously this bug can be used to shut down the SMB service, Active Directory authentication etc resulting in an obvious but nether the less anoying at the very least DoS attack. Whilst there is now a patch available there are the usual admin hurdles to jump.

Since SMB is now a "well established" protocol and fault injection attacks likewise well known it's surprising this has poped up... Anyway if it effects you, you can read more,

Clive RobinsonDecember 22, 2017 3:35 AM

@ 65535,

As I understand, the BBC is funded by the UK upper class and mostly controlled by that class.

The BBC's funding comes from a "licence fee" that all TV users and Live2PC users of their video content are legaly obligated to buy. And legaly the BBC are required to provide "balanced reporting".

The downside of "balanced reporting" is as implemented the way the current government incumbrents want it lets the "crazies" have a voice to spout their nonsense effectively unchallenged. Which was quite noticable during the Brexit run up.

Unfortunatly the current political encumbrants have used it as an excuse to get what are seen as rapid pro right wing types like Sahra Sands to move in in editorship positions much to the detriment of flagship programs. In essence she appears to be replacing "Social news" with "Society frappery". Thus much that would be an embarrassment to the current political encumbrants gets diverted for non politicaly embarrassing "fill". It's known to be of concern to those at board level and senior managment.

There are also questions arising as to what she is upto... She used to be editor at the Evening Standard on more than twice her now BBC salary. Also her leaving was quite sudden and left her position open to be filled by the Ex Chancellor George "gidiot" Osborne who had just been sacked by the replacment Prime Minister Theresa May. Her leaving appears to have ruffled no feathers, thus appears not just pland for some time but with the full support of various people. Gidiot is now having a "rapid fire" snipper policy at May and Co. So in one move Sarha Sands has curried favour with both factions in the Conservative Party. Which is why many are wondering what the "Pay Off" will be, and when.

JG4December 22, 2017 12:34 PM

wishing everyone who celebrates a winter holiday a happy, safe and sane time. it has not escaped my keen notice that I owe some comments on various topics. I appreciate the good discussions and especially the skepticism.

Links 12/21/17 | naked capitalism - Tor Browser
Posted on December 22, 2017 by Yves Smith


Wackiest tech gadgets you can gift USAToday. UserFriendly:

​Wow, USATODAY made a holiday wish list for @internetofshit!!!
#1 Creepy Robot that essentially is a Roomba that spys on you taking pictures and videos instead of cleaning the house.​

Apple’s iPhone Throttling Will Reinvigorate the Push for Right to Repair Laws Motherboard. Hahaha.


New Cold War

Facebook: Russia spent 97 cents meddling in Brexit vote USAToday. UserFriendly: “ROFLLLLLL That really puts the billion Clinton set on fire to shame.​ Seriously Putin should move here and put all the DC strategists out of business.”

Suspicious ‘Russian diplomat’ removed from UK Parliament debate is actually American RT (Kevin W_

Big Brother is Watching You Watch

Your home was not so secure after all Medium (EM)

U.S. lawmakers seek temporary extension to internet spying program Reuters


Anonymous2dDecember 22, 2017 4:29 PM

"Facebook: Russia spent 97 cents meddling in Brexit vote USAToday. UserFriendly: “ROFLLLLLL That really puts the billion Clinton set on fire to shame.​ Seriously Putin should move here and put all the DC strategists out of business.”"

Is it too late for the UK to say something like we were hacked by: the Mercers, Breitbart, Putin, Cambridge Analytica, etc., so let's just admit Brexit was a stupid idea and have another referendum or election?

I recall seeing in the last week or two somewhere that Putin's active measures against the USA election may have cost about 500,000 USD (Washington Post maybe). Did anybody else see that or have a reference about the estimated cost. I do recall, I think, former DNI Director Clapper saying something like 'Putin got a lot of mileage per dollar spent during the 2016 USA election'.

In addition, iirc, in the book Collusion, Harding says a high-up official in the Russian government was telling Putin something like don't be too aggressive with the 2016 USA election. I wonder what Putin sees as the current assets and liabilities of his 2016 active measures campaign against the USA election.

Finally, how are the new USA sanctions, due to be implemented against Russia and oligarchs, I think, coming along? Aren't they supposed to be implemented before the upcoming Russian presidential election in 2018?

Sancho_PDecember 22, 2017 5:54 PM


Yes, the PC “evidence” should end that case before it’s beginning.

But in my opinion (pure speculation, as always, only based on colored MSM reporting) the cops also made serious mistakes in that case.

To search while Gartenlaub was out for vacation was a very bad mistake. Who would leave incriminating stuff (C-17) at home, ready for a burglar? I definitely would not.
The same goes for unencrypted CP, but on the contrary, that it “was found”, openly lying there, strongly indicates he didn’t know about.

But the basic issue is their secrecy. While silent surveillance often is necessary, after having a target, the open, direct approach is always better.
Treat the suspect with respect. Ask, confront, be bold, be honest, act like a matured civilized person, do not cowardly hide behind the curtain.
A sissy will always lose.

1) Mr. Gartenlaub, we still suspect … here is our search order. Be warned, you are under firm surveillance.
2) Mr. Gartenlaub, we didn’t find anything re our search order, but we found …

Hey, it doesn’t need a genius, even my neighbor’s dog would immediately sniff whether the guy lies or desperately wants to cooperate.
Also they would know beforehand if he was a well trained agent after doing some background search.

Even when behaving behaving like a coward is their standard, they could have, after the first search, not talked about CP but arrange a second “search” and plant a trap to report image access.
At best the CP “possession” could be used to give him a slap on his fingers, to make it a crime scene is … American?

Probably the LEO’s method to acquire “informants” by bribery often leads to fabricated “evidence” or suspicion which can’t be shown in a trial to protect “sources”. Then they search in endless circles and finally must point at someone.
In this context check how they found terrorists, e.g.

“The outcome of this case could negatively affect the NSA/FBI/Police.”
I don’t think so, this is USA, too much patriotism and right wing authoritarian thinking. It’s interesting to ponder of e.g. UK, France, Spain or Germany in this respect, but there is always the difference what the ordinary people would think and what the gov (= justice) in reality would do (or not) - if, and you are right, that’s a big if, if the MSM would report at all.

A sad situation, anyway.

ChrisDecember 22, 2017 11:26 PM

I would not be surprised if the hourly cost of CNN's anti-Trump programming far exceeds the total cost of Russia's alleged US-election related ads on facebook.

Chris stop being dense.December 27, 2017 6:42 PM

"CNN's anti-Trump programming"

CNN reports the news.

The news is, factually, that Trump is a traitor who lies constantly in denial of things we know already.

Sorry, CNN isn't making it up nor are they the only ones reporting the facts.

Conservative sn*wflakes need to get off the traitor train - or go to prison with him.

Leave a comment

Allowed HTML: <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre>

Photo of Bruce Schneier by Per Ervland.

Schneier on Security is a personal website. Opinions expressed are not necessarily those of IBM Resilient.